Security checks for vulnerabilities and agentic risk
Overview
The skill appears to run the advertised BTCD collateral workflow, but it handles real private keys and mainnet funds with weak state, secret, and transaction-safety controls.
Install only after reviewing the scripts and using wallets funded with the minimum necessary amount. Do not reuse high-value private keys in the .env file, avoid shared/CI environments, confirm all transaction destinations and amounts manually, and treat reruns or setup resets as dangerous until state handling is fixed. The concerns found warrant Review rather than an outright malicious classification because the core behavior is disclosed and purpose-aligned, but the safety controls are not strong enough for unattended mainnet use.
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (6)
T09 · Insecure Skill Coding Practices
Error
Location
scripts/02-lock-btc-collateral.js:79
Finding
BTC collateral can be transferred twice when broadcast state is not persisted
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
Location
scripts/setup.js:27
Finding
Setup unconditionally overwrites transaction replay-protection state
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/utils/proof-generator.js:153
Finding
Loan claim preimage is logged and stored in plaintext with default permissions
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/utils/state-manager.js:9
Finding
User-controlled state filenames permit directory traversal and arbitrary JSON-file access
Content
View full analysis
Remediation
View remediation
T08 · Insecure Dependencies
Warning
Location
scripts/package.json:16
Finding
Dependency installation is not reproducible because no lockfile or exact versions are provided
Content
View full analysis
Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
Location
scripts/06-repay-loan.js:122
Finding
Repayment signing falls back to an unverified BTC output
Content
View full analysis
{
// Handle different API formats
if (v.scriptPubKey?.addresses?.includes(lockBtcStep.scriptAddress)) return true;
if (v.scriptPubKey?.address === lockBtcStep.scriptAddress) return true;
if (v.scriptpubkey_address === lockBtcStep.scriptAddress) return true;
return false;
});
if (scriptOutputIndex === -1) scriptOutputIndex = 0; // Fallback to first output
}
```
The selected output value is then used in the witness signature at lines 153-166:
```js
const loanScript = await orderContract.loanScript();
const scriptBuffer = Buffer.from(loanScript.slice(2), 'hex');
// Sign with borrower's key
logger.info('Signing repayment transaction with borrower key...');
const hashForWitness = unsignedBtcTx.hashForWitnessV0(
0,
scriptBuffer,
orderSatsValue,
bitcoin.Transaction.SIGHASH_ALL
);
const signature = btcKeyPair.sign(hashForWitness);
```
### Technical Analysis
If the expected lock-script address cannot be found in data returned by the BTC API, the code silently chooses output zero. It then uses that output's value when constructing the SegWit signature hash.
A missing match should be treated as a critical integrity failure. It may indicate malformed provider data, stale or corrupted local state, an incorrect BTC transaction ID, or a transaction that did not pay the expected script. Falling back to an unrelated output can produce an invalid signature or authorize a transaction under assumptions that were never verified.
The code also hardcodes input index zero for `hashForWitnessV0()` without verifying that the repayment transaction's first input spends the identified collatera
...[truncated 997 chars]
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content
Scanner excerpt · SKILL.md (reported line 121)May include surrounding context.
automated:
Checks state/flow-state.json first. If a btcTxId already exists, it resumes confirmation waiting instead of sending new BTC.
If already completed (confirmations >= 3), it skips entirely.
Defaults to standard collateral amount (no staking discount).
Broadcasts BTC tx and waits for 3 confirmations (~30 min).
Safe to re-run if interrupted — it will never double-send BTC.
Step 4: Submit BTC Proof
bash
npm run 03-submit-proof
Generates ZKP proof from the BTC transaction and submits to the EVM order contract.
Skip 04-arbiter-fee — not needed.
Step 5: Claim BTCD Tokens
bash
npm run 05-claim-btcd
Calls borrow() with the preImage from Step 2. BTCD tokens are minted to your EVM wallet.
Step 6: Repay Loan (ONLY when explicitly requested by user)
bash
npm run 06-repay
Calculates repayment (principal + interest), approves BTCD, signs the BTC repayment transaction, and calls repay().
**DO N
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill reportedly supports arbitrary state-file reads/writes, archiving, and caller-influenced state-file selection, which goes beyond the declared workflow and can become dangerous if filenames or paths are attacker-controlled. In an agent setting, hidden filesystem flexibility can enable overwriting files, reading unintended state, or manipulating execution flow via crafted state inputs.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding
The skill reportedly supports arbitrary state-file reads/writes, archiving, and caller-influenced state-file selection, which goes beyond the declared workflow and can become dangerous if filenames or paths are attacker-controlled. In an agent setting, hidden filesystem flexibility can enable overwriting files, reading unintended state, or manipulating execution flow via crafted state inputs.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill reportedly supports arbitrary state-file reads/writes, archiving, and caller-influenced state-file selection, which goes beyond the declared workflow and can become dangerous if filenames or paths are attacker-controlled. In an agent setting, hidden filesystem flexibility can enable overwriting files, reading unintended state, or manipulating execution flow via crafted state inputs.
Content
No source excerpt is available for this finding.
Tp4
High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding
The skill reportedly supports arbitrary state-file reads/writes, archiving, and caller-influenced state-file selection, which goes beyond the declared workflow and can become dangerous if filenames or paths are attacker-controlled. In an agent setting, hidden filesystem flexibility can enable overwriting files, reading unintended state, or manipulating execution flow via crafted state inputs.
Content
No source excerpt is available for this finding.
Credential Access
High
Category
Privilege Escalation
Confidence
96% confidence
Finding
The skill instructs users to place both EVM and BTC private keys into a local .env file for use by bundled automation scripts. This is dangerous because plaintext secret storage materially increases the risk of credential theft through local compromise, accidental logging, shell history mishandling, backups, or other tooling that reads environment files.
Content
Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
Create .env from the template. Only two values need changing:
bash
cp .env.template.txt .env
Edit .env and set:
EVM_PRIVATE_KEY — your EVM private key (with 0x prefix)
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
98% confidence
Finding
The ABI includes destructive operational methods like frozenArbitrator and terminateArbitratorWithSlash, as well as release/working-state controls, which are highly sensitive and not justified by the declared end-user purpose of creating or managing BTCD loans. If an agent has access to these methods and a sufficiently privileged signer, a malicious prompt, compromised workflow, or operator mistake could freeze or slash arbitrators and disrupt protocol operations or destroy economic value.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The ABI includes direct asset-withdrawal functions like withdrawETH and withdrawToken, enabling transfer of native currency or tokens to arbitrary recipients if the caller has sufficient privileges or if surrounding tooling signs such calls. Because the skill is presented as a collateralization/loan-flow assistant rather than an admin treasury tool, these capabilities are especially dangerous: a prompt-injected or confused agent could facilitate unauthorized asset exfiltration.
Content
No source excerpt is available for this finding.
Credential Access
High
Category
Privilege Escalation
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content
Scanner excerpt · scripts/setup.js (reported line 45)May include surrounding context.
This function logs the raw 32-byte preimage and its hash, exposing a secret that is typically intended to authorize or unlock value in hash/preimage-based flows. In a BTCD collateralization and proof-generation context, disclosure of the preimage through logs can let anyone with log access redeem, claim, front-run, or otherwise interfere with the protocol step that relies on secrecy, especially because automation logs are often shipped to centralized observability systems or shared with operators.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The comment explicitly states the environment-variable override exists so 'attack scripts' can use a separate state file, which is inconsistent with the declared BTCD collateralization purpose. While comments do not execute, they document intentional support for offensive or deceptive use cases, increasing the likelihood that the surrounding state-redirection capability was added to facilitate misuse or stealthy alternate execution paths.
Content
No source excerpt is available for this finding.
Intent-Code Divergence
High
Category
Not specified by scanner
Confidence
99% confidence
Finding
The loadStateFrom documentation says it is used by 'attack scripts' to read original state while writing to a different file, describing a mechanism for shadow-state operation. In the context of a financial BTCD loan/collateralization skill, that can enable covert manipulation, replay, or evasion of normal workflow tracking by separating observed state from modified state.
Content
No source excerpt is available for this finding.
Undeclared Tool Scope
Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill instructs the operator to handle private keys and run code that can access environment variables, but it declares no explicit tool scope or permission boundaries. In a high-risk blockchain automation skill, the absence of clear allowed-tools/permissions increases the chance that an agent executes sensitive actions or accesses secrets without adequate guardrails.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The trigger condition is broad: it activates for a wide set of requests involving loans, order creation, BTC locking, proofs, claims, and repayment. For a skill that can sign transactions and move funds across Bitcoin and EVM environments, ambiguous activation boundaries increase the risk of accidental invocation for high-consequence actions.
Content
No source excerpt is available for this finding.
External Transmission
Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · SKILL.md (reported line 181)May include surrounding context.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content
Scanner excerpt · scripts/.env.template.txt (reported line 5)May include surrounding context.
text
# Agent must set their own EVM_PRIVATE_KEY and BTC_PRIVATE_KEY
EVM_PRIVATE_KEY=<AGENT_EVM_PRIVATE_KEY>
EVM_RPC_URL=https://api.elastos.io/pg
BTC_PRIVATE_KEY=<AGENT_BTC_PRIVATE_KEY_NO_0x_PREFIX>
BTC_NETWORK=mainnet
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The ABI exposes numerous privileged governance and arbitrator-administration functions such as ownership transfer, manager reconfiguration, pausing, whitelist updates, and role-setting that go well beyond an end-user BTCD loan or collateralization workflow. In a skill context, bundling these capabilities increases the chance the agent could invoke high-privilege operations if prompted, misconfigured, or connected to a signer with elevated permissions, expanding the attack surface unnecessarily.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding
The ABI exposes privileged administrative functions such as changing operator, stablecoin, and loan contract addresses, as well as ownership transfer and withdrawal methods that are not aligned with the skill's stated user-facing purpose of running a BTCD collateralization flow. In an agent-skill context, exposing these methods increases the chance the agent could be induced or misconfigured to invoke sensitive contract-management actions, leading to fund loss or protocol reconfiguration outside user expectations.
Content
No source excerpt is available for this finding.
Description-Behavior Mismatch
Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding
The ABI exposed by the skill includes privileged administrative methods such as ownership transfer, factory/tool updates, timing changes, and interest receiver changes that go beyond the declared end-user BTCD loan-flow purpose. In an agent skill context, exposing these calls materially increases the chance that the agent could be induced to perform dangerous protocol-administration actions against a live contract, potentially redirecting funds, changing trust dependencies, or breaking loan lifecycle guarantees.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The administration-oriented ABI surface is not justified by the skill metadata, which describes operational loan actions rather than governance or contract management. In practice, this mismatch enables prompt-injection or misuse scenarios where an agent may be tricked into calling sensitive setters or ownership functions under the guise of normal loan execution, making the skill substantially more dangerous than advertised.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding
This JSON ABI exposes a nonpayable renounceOwnership function, which is an irreversible administrative action, but the file contains no comments, descriptions, or other user disclosure explaining that calling it can permanently remove owner privileges. For code/JSON interface artifacts, this qualifies as a missing warning when a safety-critical operation is present without any visible disclosure in the file.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
81% confidence
Finding
The ABI includes transferOwnership(address newOwner), which changes administrative control and can materially affect system integrity, yet this file provides no visible warning, prompt, or explanatory text about that effect. Because the file is a manifest-style JSON artifact consumed by tools, the absence of any disclosure for this safety-critical operation is a quality/safety gap.
Content
No source excerpt is available for this finding.
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
