BLE → $ANIMA Minter

PassAudited by VirusTotal on May 12, 2026.

Overview

Type: OpenClaw Skill Name: ble-anima-minter Version: 1.0.0 The skill bundle is classified as benign. The `anima_minter.py` script performs BLE scanning to detect MAC addresses, hashes them with a hardcoded salt, and stores the resulting hashes in a local DAG file (`anima_dag.gpickle`) using the `networkx` library. While BLE scanning requires elevated privileges (e.g., raw socket access), this is the core stated purpose of the skill. There is no evidence of data exfiltration, malicious execution, persistence mechanisms, or prompt injection attempts against the agent in `SKILL.md`. All actions are directly aligned with the described functionality.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Running the script can observe nearby devices during the scan window.

Why it was flagged

The script actively starts a BLE scan, which is central to the skill but means running it collects nearby Bluetooth device identifiers.

Skill content

socket = aiobs.create_bt_socket(0)
...
await protocol.send_scan_request()
print("Scanning for 10 seconds...")

Recommendation

Run it only when you intend to scan the local Bluetooth environment and are comfortable collecting nearby device identifiers.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

The local file and terminal output may retain or expose records derived from nearby Bluetooth identifiers.

Why it was flagged

Observed MACs are hashed with a fixed salt, printed in raw form to the console, and stored persistently as a local DAG file.

Skill content

SALT = "anima2026"
...
print(f"Detected MAC: {mac_str}  Hash: {h}")
...
nx.write_gpickle(G, "anima_dag.gpickle")

Recommendation

Treat anima_dag.gpickle and any terminal logs as privacy-sensitive, delete them when no longer needed, and avoid sharing them casually.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Future dependency versions could behave differently from the versions the author tested.

Why it was flagged

The dependencies are not version-pinned, so installation resolves whatever package versions are current in the package index.

Skill content

aioblescan
networkx

Recommendation

Pin and review dependency versions before installing, especially for Bluetooth-access packages.