Bittensor Sn85 Vibe Miner

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:05 AM UTC
• Version: 2.1.0

Overview

This mining guide is mostly purpose-aligned, but it gives users risky deployment steps involving wallet material, root access, public services, and unverified software installs on a rented host.

Review carefully before installing. Use dedicated low-value miner hotkeys only, never copy coldkey or broad wallet directories to a rented instance, pin and verify all downloaded code and binaries, avoid running the miner as root, expose only the required ports with appropriate network controls, and do not overwrite system DNS without a backup and rollback plan.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:112
• Finding: Mutable FFmpeg Release Is Installed System-Wide Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:112-119` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash ### Install Optimized ffmpeg System ffmpeg lacks NVENC. Use BtbN static build: ```bash cd /tmp wget https://github.com/BtbN/FFmpeg-Builds/releases/download/latest/ffmpeg-master-latest-linux64-gpl.tar.xz tar xf ffmpeg-master-latest-linux64-gpl.tar.xz sudo cp ffmpeg-master-latest-linux64-gpl/bin/* /usr/local/bin/ ffmpeg -version | grep libsvtav1 # Verify AV1 support ``` ### Technical Analysis The instructions retrieve a precompiled executable archive through the mutable `latest` release URL. They do not pin a release version, verify a cryptographic checksum, or validate a release signature. Consequently, the effective binaries installed by the instructions can change after the Skill has been reviewed. The extracted executables are copied with `sudo` into `/usr/local/bin`, a system-wide executable search location. This can replace existing tools or introduce additional executable files. The subsequent `ffmpeg -version` command then executes the installed binary. Downloading FFmpeg is relevant to the declared video-processing functionality, but using an unpinned artifact and installing every archive binary system-wide exceeds the minimum privilege required. A private application directory containing only the required binaries would be sufficient. ### Attack Path 1. An attacker compromises the upstream release account, build pipeline, or mutable `latest` release artifact. 2. The attacker publishes an archive containing a modified `ffmpeg` binary or additional malicious executables. 3. A user follows the Skill and downloads the changed archive without checksum or signature validation. 4. `sudo cp ... /usr/local/bin/` installs the attacker-controlled files into a privileged system-wide path. 5. The verification command or later miner processing executes the malicious binary. 6 ...[truncated 580 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin FFmpeg to a specific, immutable release version rather than `latest`. 2. Publish the expected SHA-256 digest in the Skill and verify it before extraction: ```bash echo '<EXPECTED_SHA256> ffmpeg-release.tar.xz' | sha256sum --check - ``` 3. Prefer upstream signature verification where signed artifacts are available. 4. Download with failure handling and secure transport settings, such as `curl --fail --location --proto '=https'`. 5. Extract into a newly created application-owned directory rather than a shared `/tmp` path. 6. Install only the required `ffmpeg` and `ffprobe` files under a dedicated versioned directory, such as `/opt/vidaio/ffmpeg/<version>/bin`. 7. Run the miner under a dedicated unprivileged account and reference the binaries through an explicit absolute path. 8. Do not copy every file from an externally supplied `bin` directory into `/usr/local/bin`. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:94
• Finding: Unpinned Repository Code and Python Dependencies Are Installed Without Reproducible Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:94-103` **Vulnerability Type**: Insecure third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash # Clone repo cd /root git clone https://github.com/Cazure8/vidaio-subnet.git cd vidaio-subnet # Install dependencies python3 -m venv venv source venv/bin/activate pip install -e . ``` An additional package is installed at `SKILL.md:121-125`: ```bash ### Install video2x for Upscaling ```bash pip install video2x==6.3.1 # Downloads NCNN models automatically on first run ``` ### Technical Analysis The miner repository is cloned from its default branch without checking out a reviewed commit or release tag. `pip install -e .` executes packaging and build behavior from whatever repository content is present at installation time and resolves its dependencies without a hash-locked manifest shown by the Skill. Although `video2x` is version-pinned, the instruction does not verify package hashes or lock transitive dependencies. It also states that additional model files are automatically downloaded on first use, but no source or integrity-validation mechanism is documented. These components are necessary for the declared mining functionality, but mutable source installation and unresolved transitive dependencies create avoidable supply-chain exposure. ### Attack Path 1. An attacker compromises the miner repository, package publisher, dependency account, or associated distribution pipeline. 2. Malicious installation logic is added to the default branch, a dependency release, or an automatically downloaded model artifact. 3. A user clones the current default branch and runs `pip install -e .`. 4. Package build or installation hooks execute in the deployment environment, or the malicious dependency executes when imported. 5. The miner later downloads or loads an unverified model and processes attacker-controlled content with it. ### Impact Assessment Malicious package instal ...[truncated 416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the miner source to a reviewed full commit hash: ```bash git clone https://github.com/Cazure8/vidaio-subnet.git cd vidaio-subnet git checkout --detach <REVIEWED_FULL_COMMIT_HASH> ``` 2. Verify signed commits or signed release tags when supported. 3. Generate and review a complete dependency lock file. 4. Install Python packages with hashes, for example through a requirements file using `pip install --require-hashes`. 5. Record hashes and trusted origins for automatically downloaded NCNN model files. 6. Disable automatic model downloads in production where possible; provision verified models during a controlled build stage. 7. Build the environment as an unprivileged service account rather than under `/root`. 8. Re-audit and explicitly update pinned versions instead of tracking mutable branches. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:105
• Finding: Entire Bittensor Wallet Directory Is Copied to a Third-Party Root Host<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:105-106` **Vulnerability Type**: Excessive credential transfer and least-privilege violation **Risk Level**: High ### Vulnerable Code ```bash # Copy wallets from local machine scp -P <VAST_SSH_PORT> -r ~/.bittensor/wallets/moltypython root@<VAST_IP>:/root/.bittensor/wallets/ ``` ### Technical Analysis The command recursively transfers the complete named Bittensor wallet directory to a rented Vast.ai instance and stores it in the root account. The declared miner operation requires only dedicated operational hotkeys. Recursively copying the wallet directory may also transfer coldkey data, unrelated hotkeys, metadata, or other wallet material that is unnecessary for mining. SSH/SCP provides transport encryption, so the primary issue is not plaintext network exposure. The issue is excessive credential scope and placement of sensitive wallet data on a third-party host with a broad root security boundary. ### Attack Path 1. The user creates a wallet containing the coldkey and the two miner hotkeys described by the Skill. 2. The user follows the recursive `scp` command. 3. All files under the wallet directory are copied to the rented instance, including any material not needed by the miner. 4. The cloud provider, a compromised host image, an exposed root SSH service, a malicious dependency, or another root-level process accesses the copied files. 5. If keys are usable or their passwords are subsequently exposed, the attacker impersonates hotkeys or accesses wallet capabilities represented by the transferred material. ### Impact Assessment At minimum, compromise may expose miner identities and allow hotkey impersonation, unauthorized subnet operations, or disruption of mining activity. If transferable coldkey material is included and can be unlocked, the impact may extend to wallet ownership and financial assets. The scope is greater than necessary because the entire wallet directory is copied to a ...[truncated 41 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Keep the coldkey offline and never copy it to the mining instance. 2. Create dedicated hotkeys exclusively for this miner and transfer only the exact files required to operate those hotkeys. 3. Document the required Bittensor wallet file layout explicitly rather than recursively copying the parent wallet directory. 4. Use an unprivileged dedicated miner account instead of `root`. 5. Set restrictive ownership and permissions immediately: ```bash chown -R vidaio:vidaio /home/vidaio/.bittensor chmod -R go-rwx /home/vidaio/.bittensor ``` 6. Encrypt sensitive key material at rest and avoid supplying passwords through command-line arguments or logs. 7. Restrict SSH using key-only authentication, a source-IP allowlist, and disabled direct root login. 8. Rotate the miner hotkeys and inspect wallet activity if the third-party instance is suspected of compromise. ]]>

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:241
• Finding: Global DNS Configuration Is Overwritten with Public Resolvers<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:241-244` **Vulnerability Type**: Over-privileged global network configuration modification **Risk Level**: Medium ### Vulnerable Code ```bash ### 4. DNS Fix (Docker resolver issue) ```bash echo -e "nameserver 8.8.8.8\nnameserver 1.1.1.1" | sudo tee /etc/resolv.conf ``` ### Technical Analysis The command overwrites the host-wide resolver configuration using elevated privileges. It does not preserve existing search domains, internal resolvers, DNSSEC-related behavior, split-DNS configuration, or platform-provided service discovery. Changing DNS may be relevant to resolving a container networking problem, but replacing `/etc/resolv.conf` for every process is broader than necessary. On managed systems, this file may also be maintained by `systemd-resolved`, NetworkManager, Docker, or the cloud provider, making direct replacement fragile and potentially temporary. ### Attack Path 1. A user encounters the documented resolver issue and runs the command with `sudo`. 2. Existing provider or internal DNS settings are removed. 3. All processes using the standard resolver begin sending DNS requests to the specified public services. 4. Internal names or provider services cease resolving, while DNS query metadata is disclosed to the public resolver operators. 5. If the changed resolver behavior interferes with package, repository, or miner endpoint resolution, services may fail or connect to unintended destinations depending on the surrounding DNS and application validation controls. ### Impact Assessment The change affects the entire host rather than only the miner. It can cause denial of service for internal names, bypass enterprise or provider DNS policy, disclose DNS queries to third parties, and interfere with platform service discovery. It does not by itself grant an attacker root access, but it uses root privilege to make an unnecessarily broad system configuration change. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Diagnose the underlying Docker or platform resolver failure before changing host-wide settings. 2. Configure DNS only for the miner container or service, using the platform's supported per-container DNS option. 3. If host configuration is required, use the active resolver manager rather than directly replacing `/etc/resolv.conf`. 4. Preserve required internal resolvers, search domains, and provider-specific service-discovery settings. 5. Prefer trusted organization- or provider-managed resolvers where available. 6. Back up the existing resolver configuration and provide an explicit rollback procedure. 7. Verify DNS resolution and DNSSEC/TLS certificate validation after any controlled change. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Chaining Abuse

High

• Category: Tool Misuse

Content

### 4. DNS Fix (Docker resolver issue)

```bash
echo -e "nameserver 8.8.8.8\nnameserver 1.1.1.1" | sudo tee /etc/resolv.conf
```

## Monitoring

• Confidence: 75% confidence
• Finding: Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Bittensor wallet with at least 0.4τ for registration
btcli wallet create --wallet.name moltypython
btcli wallet new_hotkey --wallet.name moltypython --hotkey mining
btcli wallet new_hotkey --wallet.name moltypython --hotkey mining2

• Confidence: 78% confidence
• Finding: The skill instructs the creation and ongoing use of persistent wallet identities and hotkeys on a remote mining setup, which creates long-lived authentication material that may remain accessible on disk and across restarts. In this context, session or key persistence is risky because the same credentials are later copied to a rented host, increasing exposure if the machine is compromised or reused.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly instructs the user to expose backend miner services publicly through Caddy and to remove authentication so remote validators can reach them, but it does not clearly warn that this makes the services internet-accessible. Publicly exposing Flask-backed services handling video workloads increases attack surface for unauthorized access, denial of service, and exploitation of any latent service vulnerabilities.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Edit /etc/caddy/Caddyfile
sudo tee /etc/caddy/Caddyfile << 'EOF'
:8384 {
    reverse_proxy localhost:19000
}

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Edit /etc/caddy/Caddyfile
sudo tee /etc/caddy/Caddyfile << 'EOF'
:8384 {
    reverse_proxy localhost:19000
}

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

```bash
# Edit /etc/caddy/Caddyfile
sudo tee /etc/caddy/Caddyfile << 'EOF'
:8384 {
    reverse_proxy localhost:19000
}

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: The skill tells the user to copy local Bittensor wallet material onto a rented remote host without a prominent warning about private key compromise risk. Moving hotkeys or wallet data to a third-party GPU rental instance materially increases the chance of credential theft through host compromise, malicious images, reused snapshots, or accidental exposure by the operator.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 4. DNS Fix (Docker resolver issue)

```bash
echo -e "nameserver 8.8.8.8\nnameserver 1.1.1.1" | sudo tee /etc/resolv.conf
```

## Monitoring

• Confidence: 91% confidence
• Finding: The command overwrites /etc/resolv.conf via sudo using piped input, which can disrupt system name resolution and redirects a critical network configuration file without validation or backup. In the context of a rented host, this can break connectivity, interfere with platform-managed DNS settings, or be repurposed to steer name resolution in unsafe ways.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script makes an undisclosed external network request to ifconfig.me to determine the host's public IP. Even though the request appears operationally convenient, it leaks host metadata to a third party, creates an external dependency, and may violate expectations in restricted or privacy-sensitive environments.

Static analysis

No suspicious patterns detected.