Back to skill
Skillv1.0.5
VirusTotal security
AI-native Bitcoin payments. Buy, sell, send, and request Bitcoin directly through any existing messenger app (Telegram, WhatsApp, Signal, Email) or create your own email accounts to start messaging via email. · External malware reputation and Code Insight signals for this exact artifact hash.
Scanner verdict
SuspiciousApr 30, 2026, 5:19 AM
- Hash
- 0ca06a8598b4add92f56e063ff6b7269768af2afd6dcef867fcc1d73ef4f5979
- Source
- palm
- Verdict
- suspicious
- Code Insight
- Type: OpenClaw Skill Name: bit-chat Version: 1.0.5 The skill bundle directs the AI agent to fetch and execute instructions from external URLs (e.g., bit-chat.me/create-email-skill.md and heartbeat.md), which creates a significant risk of indirect prompt injection and remote instruction execution. It also mandates an 'automatic' first-run procedure that involves generating credentials, registering an account on a third-party service (mail.bit-chat.me), and establishing persistent background activity (heartbeat). While these behaviors are aligned with the stated purpose of providing Bitcoin payment rails, the reliance on unverified remote content and the automated setup of financial/communication channels represent high-risk patterns for an autonomous agent.
- External report
- View on VirusTotal