Bittensor SDK

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:52 PM UTC
• Version: 2.0.0

Overview

This is a documentation-only Bittensor SDK skill, but it broadly covers real wallet and blockchain operations without enough built-in safety framing for irreversible actions.

Review carefully before installing. Treat this skill as a broad SDK reference, not a safety layer: do not let an agent submit transfers, staking changes, liquidity actions, proxy changes, coldkey swaps, registrations, crowdloans, or root/admin calls without explicit human approval, destination/address verification, fee and slippage checks, and testnet or dry-run validation where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (135)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This section prominently documents wallet, staking, liquidity, proxy, coldkey swap, and other transaction-capable operations but does not provide clear warnings that these actions can spend funds, change ownership, or have irreversible on-chain consequences. In a skill intended for agent use, omission of such guardrails materially increases the chance of unsafe assistance and accidental financial loss.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The extrinsics and operational sections enumerate destructive or privileged actions such as proxy execution, coldkey swaps, crowdloans, staking transfers, and root-related operations without a strong warning about permanence, authority requirements, or financial risk. Because these are not merely informational queries, the lack of risk framing makes misuse and unsafe automation more likely.

Missing User Warnings

High

• Confidence: 92% confidence
• Finding: The coldkey swap operation transfers all assets, stakes, ownerships, and hotkey associations to a new coldkey, which is effectively a full account migration with potentially catastrophic consequences if the new address is wrong or attacker-controlled. Because this SDK is explicitly for wallet and chain operations, the lack of a prominent warning makes accidental or socially engineered misuse substantially more dangerous than in a generic reference.

Missing User Warnings

High

• Confidence: 95% confidence
• Finding: This function transfers stake to another coldkey, yet the documentation does not explicitly warn that an incorrect destination_coldkey_ss58 can cause irreversible loss of control over funds once the transaction is finalized. In a blockchain SDK, destination-address mistakes are a well-known high-severity user safety risk, and the absence of a strong warning makes misuse more likely.

Missing User Warnings

High

• Confidence: 91% confidence
• Finding: Coldkey swap operations are highly sensitive account-control actions, and documenting them without prominent warnings can contribute to dangerous misuse, especially in an agent skill intended to assist with wallet and key-management operations. Because these actions can affect ownership, recovery, and access to funds, under-warning materially increases the chance of irreversible account-impacting mistakes.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Functions[#](<#functions> "Link to this heading")

[`reset_coldkey_swap_extrinsic`](<#bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic> "bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic")(subtensor, wallet, ...[, ...]) | Resets the coldkey swap state for the given coldkey (root only).  
---|---  
[`sudo_set_admin_freeze_window_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic")(subtensor, ...) | Sets the admin freeze window length (in blocks) at the end of a tempo.  
[`sudo_set_coldkey_swap_announcement_delay_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic")(...) | Sets the announcement delay for coldkey swap.

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Functions[#](<#functions> "Link to this heading")

[`reset_coldkey_swap_extrinsic`](<#bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic> "bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic")(subtensor, wallet, ...[, ...]) | Resets the coldkey swap state for the given coldkey (root only).  
---|---  
[`sudo_set_admin_freeze_window_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic")(subtensor, ...) | Sets the admin freeze window length (in blocks) at the end of a tempo.  
[`sudo_set_coldkey_swap_announcement_delay_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic")(...) | Sets the announcement delay for coldkey swap.

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Functions[#](<#functions> "Link to this heading")

[`reset_coldkey_swap_extrinsic`](<#bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic> "bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic")(subtensor, wallet, ...[, ...]) | Resets the coldkey swap state for the given coldkey (root only).  
---|---  
[`sudo_set_admin_freeze_window_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic")(subtensor, ...) | Sets the admin freeze window length (in blocks) at the end of a tempo.  
[`sudo_set_coldkey_swap_announcement_delay_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic")(...) | Sets the announcement delay for coldkey swap.

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Memory Manipulation

High

• Category: Memory Poisoning

Content

## Functions[#](<#functions> "Link to this heading")

[`reset_coldkey_swap_extrinsic`](<#bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic> "bittensor.core.extrinsics.sudo.reset_coldkey_swap_extrinsic")(subtensor, wallet, ...[, ...]) | Resets the coldkey swap state for the given coldkey (root only).  
---|---  
[`sudo_set_admin_freeze_window_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_admin_freeze_window_extrinsic")(subtensor, ...) | Sets the admin freeze window length (in blocks) at the end of a tempo.  
[`sudo_set_coldkey_swap_announcement_delay_extrinsic`](<#bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic> "bittensor.core.extrinsics.sudo.sudo_set_coldkey_swap_announcement_delay_extrinsic")(...) | Sets the announcement delay for coldkey swap.

• Confidence: 85% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description is extremely broad ('use for any bittensor operation') and covers many unrelated, high-impact blockchain actions. In an agent routing context, this can cause the skill to be selected for vague Bittensor requests and expose users to transaction-capable flows without sufficient narrowing or confirmation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The examples demonstrate registration, weight setting, starting a public Axon server, and adding liquidity without accompanying warnings about token costs, chain side effects, external network exposure, or operational impact. Copy-paste examples in agent skills are especially risky because users may run them directly without understanding the consequences.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The manifest presents this skill as a complete Bittensor SDK reference, but these APIs let a caller dynamically compose arbitrary pallet/function calls from on-chain metadata rather than only use purpose-specific wrappers. That broad metaprogramming capability materially expands what the skill can do, including invoking admin-oriented or less-documented extrinsics, and is not directly justified by many of the higher-level wallet/staking/query use cases in the stated purpose.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: The file documents generic runtime API, state_call, query_module, query_map, and query_subtensor interfaces that allow direct low-level access to arbitrary runtime methods and storage. While still blockchain-related, this is substantially broader than a constrained task helper for wallet, staking, subnet, or metagraph workflows, and effectively turns the skill into a general chain introspection tool.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The transfer method moves TAO irreversibly to a destination address, yet the documentation presents it as a routine operation without a prominent warning about permanent fund loss from wrong addresses, wrong amounts, or disabling keep_alive. In a wallet/blockchain SDK, insufficient warning around irreversible value transfer materially increases the risk of operator error and financial loss.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The documentation states that ProxyType values 'match exactly' the runtime and should be treated as authoritative, yet the same page shows incomplete and internally inconsistent permission descriptions for several enum values. In a security-sensitive SDK covering delegation, staking, transfers, and privileged operations, this can mislead users into granting overly broad proxy rights or relying on incorrect restrictions, resulting in unintended authorization and fund or governance exposure.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation states that the client makes HTTP requests and signs messages with a user's wallet/keypair, but it does not prominently warn that user-supplied data is transmitted to remote Axons and that signatures are produced on the user's behalf. In a wallet/networking SDK, this omission can cause users to send sensitive payloads or trust unvetted endpoints without understanding the authentication and disclosure implications.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The example encourages direct use of the underlying HTTP client session to POST headers and JSON to arbitrary URLs without any adjacent warning about external transmission, trust of the destination, or possible inclusion of signed/authentication-related metadata. In the context of a blockchain wallet SDK, such examples can normalize unsafe patterns and increase the chance of accidental data disclosure to attacker-controlled endpoints.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: This documentation describes a signed, state-changing blockchain extrinsic that can modify on-chain child-key configuration, but it does not clearly warn users about the consequences of submitting the transaction. In an agent skill context, documentation may be used to drive automated actions, so omission of a transaction-risk warning increases the chance of unintended wallet use and irreversible on-chain changes.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation notes a wallet parameter but does not prominently warn that the operation requires an unlocked wallet and directly alters account-controlled child-key settings on-chain. Within a high-privilege SDK skill covering wallet and staking operations, this omission is more dangerous because users or agents may treat the function like a harmless query rather than an authorization-sensitive transaction.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes executing a coldkey swap and notes that all assets, stakes, subnet ownerships, and hotkey associations are transferred, but it does not present a prominent, explicit warning that this operation is security-sensitive and effectively irreversible for end users. In a wallet/key-management context, insufficient warning can cause operators to swap to the wrong address, misunderstand the consequences, or trigger permanent loss of control over valuable assets and permissions.

Missing User Warnings

Medium

• Confidence: 82% confidence
• Finding: This documentation exposes high-risk, fund-moving blockchain operations such as create, contribute, finalize, refund, dissolve, and withdraw without prominently warning that these actions can transfer or lock funds on-chain and may be irreversible once submitted or finalized. In an agent skill context, terse API reference text can be used directly by an automated system or copied by users, increasing the chance of unsafe execution, financial loss, or misuse of privileged wallets.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This markdown file documents actions that add, modify, remove, and toggle blockchain liquidity positions, which can directly affect wallet stake and on-chain state. While the function summaries describe what each call does, they do not include an explicit caution or warning about irreversible financial consequences, transaction fees, or the need to verify parameters before submission.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The documentation states that this function removes liquidity and credits balances back to the wallet's hotkey stake, which is a financially significant state change. The section explains parameters and behavior but does not present a user-facing warning about the impact of removing liquidity, possible fees, or the need to confirm the target position before execution.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: This documentation describes stake-moving operations that can directly affect user funds but does not prominently warn that mistakes may cause irreversible financial loss or unintended movement of all stake. In a wallet/blockchain SDK context, omission of such warnings can mislead integrators or operators into treating these calls as routine state changes rather than high-risk value transfers.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The swap-stake documentation omits a clear warning that subnet stake swaps are financially risky and may execute partially or at unfavorable effective rates depending on configuration. Because this SDK exposes options like safe_swapping, allow_partial_stake, and rate_tolerance, failing to explain the loss scenarios increases the chance of operator error and unexpected asset outcomes.

Static analysis

No suspicious patterns detected.