AI-native Bitcoin payments. Buy, sell, send, and request Bitcoin directly through any existing messenger app (Telegram, WhatsApp, Signal, Email) or create your own email accounts to start messaging via email.

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:41 AM UTC
• Version: 1.0.5

Overview

The skill is not clearly malware, but it should be reviewed because it can automatically create/contact a Bitcoin-related account, poll messages, store credentials, and guide payments without enough user approval controls.

Install only if you are comfortable with an agent contacting Bit-Chat, creating or using a mailbox, storing mailbox credentials, polling messages, and handling Bitcoin or bank-related instructions. Require explicit approval before setup, every outbound message, every payment/buy/sell/top-up action, and any bank-detail sharing; prefer a password manager or OS keychain over the plaintext fallback file.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:17

Finding

Mutable Remote Instructions and External Message Control Loop

Content

View full analysis

Remediation

View remediation

T01 · Skill Instruction Hijacking

Error

• Location: skill.md:21

Finding

Automatic Third-Party Enrollment and Communication Without Explicit Approval

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skill.md:79

Finding

Financial Operations Lack Mandatory Transaction Authorization Controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: create-email-skill.md:125

Finding

Mailbox Password Stored in a Plaintext File Without Mandatory File-Level Permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (12)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · skill.md (reported line 70)May include surrounding context.

md

00176 on WhatsApp, or BIT-CHAT.01 on Signal and say:
"What's my Lightning address?"

Forward this address to your human operator so they can top up your wallet by sending Bitcoin to it via Coinbase, Strike, Binance, Kraken, Wallet of Satoshi or any other Bitcoin lightning solution.
This is the standard first-run onboarding action for a newly installed Bit-Chat skill.

### Send Bitcoin to others

"Send 0.00001 BTC to [e-mail] via email"
"Send $5 worth of Bitcoin to @telegram_user via Telegram"
"Send 1000 sats to [phone] via WhatsApp"

### Send Bitcoin to lightning address

You can also send Bitcoin from your Bit-Chat account to another Bitcoin-lightning address like "[e-mail]" (don't confuse it with a typical email address, please). Make sure you check with your human if he has experience with that and safe-guard him from not sending his bitcoin to a wrong address in the step where he sends bitcoin via coinbase, strike, binance, kraken, etc to your bit-

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · heartbeat.md (reported line 40)May include surrounding context.

md

To verify BIT-CHAT is operational:

 ⁠
Contact any channel and send: "ping" or "status"
Expected response: confirmation within seconds

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 78% confidence

Finding

The hidden or non-printing characters near the instruction to contact Bit-Chat obscure the exact content being reviewed and can conceal behavior from users or analysis tools. In a skill that triggers external messaging and payment setup, hidden formatting increases the chance of overlooked instructions or policy evasion.

Content

Scanner excerpt · skill.md (reported line 61)May include surrounding context.

md

### Get Your Lightning Address (First Time)

 ⁠
Contact @bit_chat_bot on Telegram (or if you are using the telegram api directly via the Telegram ID 8520407416 instead of @bit_chat_me), [e-mail] via email, [phone] on WhatsApp, or BIT-CHAT.01 on Signal and say:
"What's my Lightning address?"

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 78% confidence

Finding

Hidden or unusual Unicode characters appear in the 'Buy Bitcoin' section, which can be used to conceal instructions or make security review less reliable. Although not exploitative by itself, this is suspicious in a financial workflow document and reduces transparency.

Content

Scanner excerpt · skill.md (reported line 89)May include surrounding context.

md

### Buy Bitcoin

 ⁠
"Buy $50 worth of Bitcoin"
"Buy 100 EUR in BTC"

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · create-email-skill.md (reported line 43)May include surrounding context.

Example:

bash

curl -sS https://mail.bit-chat.me/register-user.php \
  -H 'Content-Type: application/json' \
  -d '{
    "local_part": "my-agent-name",

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · create-email-skill.md (reported line 161)May include surrounding context.

bash

mkdir -p .agent-secrets
chmod 700 .agent-secrets

Recommended file contents:

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The heartbeat section instructs periodic re-reading, mailbox checks, and status checks on a broad schedule, including 'or sooner when a reply is expected.' That can cause the skill to trigger in generalized situations without a clear user-initiated boundary, leading to unintended autonomous external interactions and increased opportunity for prompt-driven abuse through incoming messages.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The instructions explicitly tell the agent to inspect unread message bodies and save operational information to local notes or secret metadata, but they do not warn about sensitive-content handling, prompt injection in email bodies, or data minimization. Because mailbox contents are untrusted external input, this creates risk of exfiltration, unsafe follow-on actions, and over-collection or retention of sensitive data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill is presented as a BitChat payment integration, but it also instructs the agent to create, persist, and continuously monitor an email mailbox. This expands the skill's capabilities into identity/account provisioning and ongoing external communications not clearly declared in the manifest, increasing risk of unexpected data handling and autonomous behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill directs the agent to automatically contact an external service, request an account-linked Lightning address, forward it to the human, and store it locally without first obtaining explicit approval. Autonomous outbound messaging and persistence of payment/account identifiers can trigger unintended account creation, privacy exposure, and unsafe financial setup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The manifest omits that the skill supports fiat on/off-ramp workflows, bank-detail collection, and payment instructions, while the body includes buying and selling Bitcoin through bank transfers and transaction notes. This mismatch can bypass user expectations and policy controls around financial operations and sensitive banking data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill instructs users or agents to share bank details, contact identifiers, and transaction-note metadata across messaging channels without a prominent privacy and fraud warning. Exposure of IBANs, owner names, PayPal emails, and channel identifiers creates meaningful privacy, impersonation, and social-engineering risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.