v1.0.0

Bitcoin

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:30 AM.

Analysis

This is a coherent instruction-only Bitcoin guidance skill, with the main notice being that its block-explorer examples may send wallet addresses or transaction IDs to mempool.space.

GuidanceThis skill appears safe to install as an educational Bitcoin guidance skill. Before using its API examples, consider whether the address or transaction ID is privacy-sensitive, and always independently verify wallet addresses, fees, and irreversible Bitcoin actions before confirming anything.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

Check raw tx with: `curl -s "https://mempool.space/api/tx/{txid}"` ... For address balance: `curl -s "https://mempool.space/api/address/{address}"`

The skill suggests querying an external block explorer with transaction IDs or Bitcoin addresses. This is expected for Bitcoin verification, but those lookups can reveal interest in particular addresses or transactions to the external service.

User impactIf a user checks their own wallet address or transaction through the suggested API, mempool.space may learn that their IP or environment queried that Bitcoin data.

RecommendationUse the examples only when comfortable sharing the queried address or transaction ID with that service, or use a trusted/self-hosted Bitcoin node or explorer for more privacy-sensitive checks.