Agent Lottery

• Risk level: Low
• Analyzed: Mar 6, 2026, 4:22 PM
• Findings: 0
• Version: 1.0.0

Overview

The skill mostly does what it says (CPU solo mining + wallet management) but has several inconsistencies and trust risks (unknown mining pool, unencrypted private key storage, config-path mismatch, and system-level install/build steps) that you should understand before installing or using it with real funds.

This skill is not obviously malicious, but proceed cautiously. Key points to consider before installing: (1) The miner connects to an external pool (btc.casualmine.com) — you must trust the pool operator because they handle submissions/payouts; an untrusted pool could keep any rewards. (2) The wallet code prints and saves private keys unencrypted in local config files; do NOT import private keys for wallets you actually use for funds. Prefer using address-only mode or use a throwaway wallet. (3) quick_status.py uses a different config path (~/.agent-lottery) than the other scripts (skill_dir/data) — this inconsistency can lead to confusion about where keys and state are stored. (4) The included installer builds and installs cpuminer-opt system-wide using sudo and apt/brew/git; review the install.sh and the cpuminer-opt repo yourself before running with elevated privileges. (5) If you want to reduce risk: run inside a disposable VM/container, inspect and test the scripts offline, verify the pool operator's reputation, or avoid importing real private keys. Additional information that would raise confidence: a published repository/homepage under a known maintainer, signatures/hashes for cpuminer binaries, or use of a well-known, reputable solo-mining proxy.