Litcoin Miner

• Outcome: Review
• Latest audit: Sep 12, 2026 · 4:02 AM UTC
• Version: 2.0.0

Overview

This skill is a high-risk crypto and AI-mining integration that discloses much of its behavior, but it delegates powerful financial and AI credentials too broadly and uses unsafe install paths.

Review before installing. Use a fresh, tightly scoped Bankr key if possible, avoid sending reusable financial or AI-provider keys to coordinator endpoints, disable relay unless you explicitly want to serve third-party AI requests, do not submit private prompts or hidden reasoning, and avoid the curl-downloaded miner or unpinned npx/pip paths unless you can verify the exact code being run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:274
• Finding: Transaction-Capable Bankr Credentials Are Disclosed to a Third-Party Coordinator<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:274-278` **Additional Locations**: `SKILL.md:302-311`, `SKILL.md:321-345`, `references/protocol.md:344-346`, `references/protocol.md:382-397` **Vulnerability Type**: Credential disclosure and excessive delegation of financial authority **Risk Level**: Critical ### Vulnerable Code ```bash # Claim via Bankr DeFi endpoint curl -s -X POST "https://api.litcoiin.xyz/v1/claims/bankr/resolve" \ -H "Content-Type: application/json" \ -d '{"bankrKey": "bk_YOUR_KEY"}' ``` The same pattern is prescribed for other financial operations: ```bash curl -s -X POST "https://api.litcoiin.xyz/v1/bankr/stake" \ -H "Content-Type: application/json" \ -d '{"bankrKey": "bk_YOUR_KEY", "tier": 2}' ``` The protocol reference confirms that all coordinator-mediated Bankr endpoints accept the credential: ```text All endpoints accept `{ "bankrKey": "bk_..." }` in the request body. ``` ### Technical Analysis The documented Bankr API key must have write access enabled. Instead of using it only with Bankr, the Skill instructs the user to send the raw bearer credential to `api.litcoiin.xyz`, a separate coordinator controlled by another trust domain. A write-enabled credential is materially more privileged than the mining task requires. The coordinator is documented as using it for claims, staking, unstaking, vault operations, debt minting, guild operations, and autonomous-agent configuration. Possession of the key may therefore permit asset-affecting requests within the permissions granted to the Bankr account. Transport encryption protects the credential in transit but does not protect it from the receiving coordinator, its application logs, administrators, backups, dependencies, or a server-side compromise. The design also conflicts with the claim that pre-encoded transaction calldata is sufficient: the coordinator could return explicit transaction data while the credential remains local. ### Attack Path 1. The u ...[truncated 1298 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Never send a reusable Bankr API key to the LITCOIN coordinator. - Keep the credential local and send it only to the official Bankr API. - Have the coordinator return explicit transaction calldata, chain ID, destination address, token amounts, and expected effects. - Display those transaction details to the user and require confirmation before local submission. - Prefer wallet signatures or short-lived, purpose-bound authorization tokens over reusable bearer credentials. - Scope authorization by contract, method, chain, maximum value, and expiration time. - Separate read-only mining operations from financial operations. - Require explicit approval for staking, vault creation, debt minting, guild deposits, and early unstaking. - Redact credentials from request logs, traces, crash reports, and analytics. - Rotate any Bankr key that has already been submitted to the coordinator. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: references/protocol.md:25
• Finding: AI Provider Credentials Enable Undisclosed Automatic Relay Work and Can Be Sent to the Coordinator<![CDATA[ ## Vulnerability Details **File Location**: `references/protocol.md:25-34` **Additional Locations**: `references/protocol.md:123-134`, `references/protocol.md:344`, `SKILL.md:197-205`, `SKILL.md:247-255` **Vulnerability Type**: Excessive credential delegation and automatic consumption of paid API capacity **Risk Level**: High ### Vulnerable Code ```python agent = Agent( bankr_key="bk_YOUR_KEY", # Bankr API key (get one at bankr.bot/api) ai_key="sk-YOUR_KEY", # AI provider key (enables relay + research mining) ai_url="https://api.venice.ai/api/v1", model="llama-3.3-70b", ) # Mine + relay (relay auto-starts when ai_key is set) agent.mine() ``` The reference explicitly documents automatic activation: ```text - Relay starts automatically in SDK v4.0.0+ when `ai_key` is set - Uses the same API key you already have — no extra cost ``` The autonomous deployment interface additionally accepts the raw key: ```text POST /v1/agent/deploy — Deploy autonomous agent `{"strategy": "...", "bankrKey": "bk_...", "aiKey": "sk-...", "config": {...}}`. Enforces 5M LITCOIN minimum balance. ``` ### Technical Analysis An AI key supplied for research mining automatically enables relay behavior unless the user explicitly sets `no_relay=True`. This changes the purpose of the credential from generating the user's own research submission to serving inference requests selected by an external marketplace. The statement that relay operation has “no extra cost” is inconsistent with the documented architecture: inference requests are executed through the user's AI-provider key and can consume provider credits, rate limits, and quota. Relay prompts may also carry untrusted or sensitive third-party content. The autonomous-agent deployment API accepts `aiKey` in a request sent to the coordinator. This exposes a reusable provider credential to the same server-side storage, logging, and compromise risks as the Bankr credential. Automatic relay ...[truncated 1312 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Disable relay mode by default. - Require a separate, explicit relay opt-in rather than inferring consent from the presence of an AI key. - Clearly disclose that relay requests can incur provider charges. - Keep AI-provider credentials local and never include them in coordinator requests. - Use a local proxy that receives coordinator jobs and independently applies policy before calling the provider. - Require separate credentials for research and relay operation. - Use provider keys restricted by model, budget, rate, and expiration where supported. - Implement hard per-request, hourly, and daily spending limits. - Allow model, token, requester, and content-policy allowlists. - Show relay workload and estimated cost before activation. - Provide an immediate stop control and default `no_relay=True`. - Rotate any provider credential previously sent to `/v1/agent/deploy`. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/protocol.md:45
• Finding: Mutable Remote Python Payload Is Downloaded and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `references/protocol.md:45-53` **Vulnerability Type**: Unverified remote code retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -O https://litcoiin.xyz/litcoin_miner.py ``` The downloaded file is then executed: ```bash python litcoin_miner.py # mine python litcoin_miner.py --claim # claim rewards on-chain ``` ### Technical Analysis The Skill directs users to download a Python program from a mutable website URL and execute it locally. The retrieved script is not included in the audited project, and the instructions provide no version pin, cryptographic signature, or expected hash. Consequently, the effective executable payload can change after the Skill has been reviewed. HTTPS authenticates the server connection but does not establish that the current script is the same artifact that was audited. A compromised website, deployment pipeline, DNS path, hosting account, or project operator can replace the script. The risk is amplified because users are instructed to configure the downloaded program with financial and AI credentials before execution. ### Attack Path 1. An attacker compromises `litcoiin.xyz`, its deployment credentials, or the hosted miner file. 2. The attacker replaces `litcoin_miner.py` with malicious Python code. 3. A user follows the documented `curl -O` instruction. 4. The mutable malicious payload is saved under the expected filename. 5. The user adds API credentials or runs the script in an environment containing those credentials. 6. Python executes the attacker's code with the user's operating-system permissions. 7. The payload steals credentials, alters transaction requests, accesses local files, or installs additional malware. ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the miner. The attacker may be able to: - Read environment variables and configuration files. - Steal Bank ...[truncated 362 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Include the complete miner source in the reviewed Skill package. - Publish immutable, versioned release artifacts rather than a mutable filename. - Provide an expected SHA-256 or stronger digest and require verification before execution. - Sign release artifacts using Sigstore, GPG, or another verifiable release-signing mechanism. - Abort installation when signature or digest verification fails. - Use reproducible builds and publish source-to-artifact provenance. - Run the miner in a restricted environment without unrelated secrets. - Do not place API keys directly into downloaded source code. - Restrict filesystem and network access to the minimum required endpoints. ]]>

T08 · Insecure Dependencies

Error

• Location: SKILL.md:57
• Finding: Unpinned Python and npm Packages Execute with Access to High-Value Credentials<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:57-60` **Additional Locations**: `SKILL.md:586-600`, `references/protocol.md:18-21`, `references/protocol.md:407`, `references/protocol.md:614-624` **Vulnerability Type**: Unsafe and unpinned third-party dependency execution **Risk Level**: High ### Vulnerable Code ```bash pip install litcoin ``` The MCP installation also executes a remotely resolved npm package: ```json { "mcpServers": { "litcoin": { "command": "npx", "args": ["-y", "litcoin-mcp"], "env": { "BANKR_API_KEY": "bk_YOUR_KEY" } } } } ``` ### Technical Analysis Although the documentation mentions SDK version numbers elsewhere, the actual installation commands do not pin those versions or verify package hashes. `pip install litcoin` resolves whichever release and transitive dependencies are current at installation time. Likewise, `npx -y litcoin-mcp` downloads and executes package code without interactive review. The MCP configuration explicitly gives that process the transaction-capable `BANKR_API_KEY`. A compromised maintainer account, malicious new release, dependency compromise, or package-registry attack could therefore substitute code after the Skill audit. Because dependencies execute locally and receive valuable credentials, the supply-chain impact is severe. No evidence proves that the current packages are malicious; the confirmed flaw is the unsafe dependency acquisition and execution model. ### Attack Path 1. An attacker compromises a package publisher, dependency, or registry distribution channel. 2. A malicious release becomes the latest version resolved by `pip` or `npx`. 3. The user follows the unpinned installation instructions. 4. The package or an installation hook executes attacker-controlled code. 5. The runtime receives `BANKR_API_KEY` and potentially AI-provider credentials. 6. The malicious package exfiltrates credentials or alters transaction and mining behavior. 7. The at ...[truncated 615 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin every direct dependency to an exact reviewed version. - Use hash-checked Python requirements, such as `pip install --require-hashes -r requirements.txt`. - Commit dependency lockfiles covering all transitive dependencies. - Replace `npx -y` with a locally installed, exact-version package whose integrity is verified. - Verify package signatures, provenance attestations, and registry ownership. - Audit installation scripts and transitive dependencies. - Run dependency code in a sandbox with restricted network and filesystem access. - Do not inject write-enabled credentials until package integrity has been verified. - Use a separate process with a minimal, scoped credential for MCP operations. - Establish an update-review process before changing pinned versions. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:224
• Finding: Internal Model Reasoning Is Automatically Exfiltrated, Permanently Retained, and Publicly Displayed<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:224-242` **Additional Location**: `references/protocol.md:89-96` **Vulnerability Type**: Automatic sensitive-data collection and permanent external disclosure **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST "https://api.litcoiin.xyz/v1/research/submit" \ -H "Content-Type: application/json" \ -d '{ "taskId": "TASK_ID", "miner": "MINER_ADDRESS", "code": "def solve(data):\n return sorted(data)", "model": "llama-3.3-70b", "reasoning": "Chain-of-thought reasoning here..." }' ``` The automatic collection and retention behavior is explicitly described: ```text **Reasoning traces**: The SDK automatically captures the model's chain-of-thought (supports `<think>` tags from DeepSeek-R1, QwQ, etc.) and submits alongside verified code. Traces are stored permanently and displayed on the Research Lab. ``` ### Technical Analysis The SDK automatically captures internal model reasoning and submits it to the external coordinator. The coordinator then stores the trace permanently and displays it publicly. Reasoning output can contain more than a sanitized explanation of the submitted algorithm. Depending on the model and surrounding application context, it may reproduce user prompts, proprietary research, system instructions, file content, credentials, personal data, or other contextual information. Permanent public retention makes accidental disclosure difficult or impossible to reverse. The behavior is not required to verify whether submitted code is correct or outperforms a baseline. A concise, user-reviewed rationale would satisfy documentation needs with substantially less exposure. ### Attack Path 1. The Agent performs research using a model that emits prose or `<think>` reasoning. 2. Sensitive context is incorporated into the model's reasoning output. 3. The SDK automatically extracts that reasoning without a separate review step. 4. The reasoning is sent ...[truncated 763 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not capture or submit raw chain-of-thought. - Generate a short, purpose-specific rationale that excludes hidden reasoning and unrelated context. - Require explicit user review and consent before every rationale is uploaded. - Apply secret scanning and personally identifiable information detection before submission. - Restrict submitted content to the task statement, final code, benchmark result, and sanitized explanation. - Make research records private by default. - Define finite retention periods and provide deletion and correction mechanisms. - Clearly disclose publication scope before submission. - Encrypt non-public records at rest and enforce access controls. - Allow reasoning submission to be disabled independently of research mining. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (51)

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill states that chain-of-thought reasoning traces are automatically captured, submitted, stored permanently, and displayed publicly, but it does not present a clear privacy/security warning before that workflow. This can leak sensitive prompts, secrets accidentally included in reasoning, proprietary logic, or internal decision traces to an external service permanently.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The SDK is documented to automatically capture model chain-of-thought and permanently store it alongside submitted code, with no strong warning about disclosure of secrets, proprietary logic, or sensitive prompt content. Permanent archival materially increases impact because once traces are uploaded, accidental leakage may be irreversible and broadly visible.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill quickly moves into write-enabled API keys, swaps, claims, staking, vaults, and autonomous agent deployment without an explicit up-front risk warning about irreversible financial actions and credential sensitivity. Users may authorize high-impact on-chain or delegated operations before understanding that the skill can spend funds and bind to their wallet.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via direct API:
```bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"
```

Extract the first Base/EVM wallet address. This is the miner address.

• Confidence: 84% confidence
• Finding: Referencing the Bankr API endpoint corresponds to real external credential use in a financial workflow. The skill context makes this more dangerous because the key is write-enabled and connected to wallet operations, so endpoint compromise or mishandling could lead to account abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via direct API:
```bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"
```

Extract the first Base/EVM wallet address. This is the miner address.

• Confidence: 84% confidence
• Finding: Referencing the Bankr API endpoint corresponds to real external credential use in a financial workflow. The skill context makes this more dangerous because the key is write-enabled and connected to wallet operations, so endpoint compromise or mishandling could lead to account abuse.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

Or via API:
```bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"
```

**If balance is zero**, use the one-time faucet:

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

**If user wants to buy more**, use Bankr:
```bash
# LITCOIN token: 0x316ffb9c875f900AdCF04889E415cC86b564EBa3
curl -s -X POST https://api.bankr.bot/agent/prompt \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $BANKR_API_KEY" \
  -d '{"prompt": "swap $10 of ETH to 0x316ffb9c875f900AdCF04889E415cC86b564EBa3 on base"}'

• Confidence: 90% confidence
• Finding: This example uses a write-capable Bankr API key to initiate a swap via an external prompt endpoint. Because it can move user funds and relies on natural-language execution, misuse, prompt ambiguity, or service compromise could trigger unintended trades with irreversible financial loss.

External Transmission

Medium

• Category: Data Exfiltration

Content

MESSAGE=$(echo "$NONCE_RESPONSE" | jq -r '.message')

# Step 2: Sign via Bankr
SIGN_RESPONSE=$(curl -s -X POST https://api.bankr.bot/agent/sign \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $BANKR_API_KEY" \
  -d "$(jq -n --arg msg "$MESSAGE" '{signatureType: "personal_sign", message: $msg}')")

• Confidence: 91% confidence
• Finding: The Bankr signing request uses the sensitive API key to produce a wallet signature through a third-party service. In a crypto setting, delegated signing is inherently high risk because compromise or misuse can authenticate or authorize actions on behalf of the user.

External Transmission

Medium

• Category: Data Exfiltration

Content

MESSAGE=$(echo "$NONCE_RESPONSE" | jq -r '.message')

# Step 2: Sign via Bankr
SIGN_RESPONSE=$(curl -s -X POST https://api.bankr.bot/agent/sign \
  -H "Content-Type: application/json" \
  -H "X-API-Key: $BANKR_API_KEY" \
  -d "$(jq -n --arg msg "$MESSAGE" '{signatureType: "personal_sign", message: $msg}')")

• Confidence: 91% confidence
• Finding: The Bankr signing request uses the sensitive API key to produce a wallet signature through a third-party service. In a crypto setting, delegated signing is inherently high risk because compromise or misuse can authenticate or authorize actions on behalf of the user.

External Transmission

Medium

• Category: Data Exfiltration

Content

SIGNATURE=$(echo "$SIGN_RESPONSE" | jq -r '.signature')

# Step 3: Verify and obtain token
VERIFY_RESPONSE=$(curl -s -X POST https://api.litcoiin.xyz/v1/auth/verify \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg miner "MINER_ADDRESS" --arg msg "$MESSAGE" --arg sig "$SIGNATURE" '{miner: $miner, message: $msg, signature: $sig}')")
TOKEN=$(echo "$VERIFY_RESPONSE" | jq -r '.token')

• Confidence: 78% confidence
• Finding: Submitting wallet, message, and signature to verify auth is expected but still security-relevant because it externalizes authentication material to the coordinator. If session management is weak, stolen verification outputs could enable unauthorized mining or account activity.

External Transmission

Medium

• Category: Data Exfiltration

Content

SIGNATURE=$(echo "$SIGN_RESPONSE" | jq -r '.signature')

# Step 3: Verify and obtain token
VERIFY_RESPONSE=$(curl -s -X POST https://api.litcoiin.xyz/v1/auth/verify \
  -H "Content-Type: application/json" \
  -d "$(jq -n --arg miner "MINER_ADDRESS" --arg msg "$MESSAGE" --arg sig "$SIGNATURE" '{miner: $miner, message: $msg, signature: $sig}')")
TOKEN=$(echo "$VERIFY_RESPONSE" | jq -r '.token')

• Confidence: 78% confidence
• Finding: Submitting wallet, message, and signature to verify auth is expected but still security-relevant because it externalizes authentication material to the coordinator. If session management is weak, stolen verification outputs could enable unauthorized mining or account activity.

External Transmission

Medium

• Category: Data Exfiltration

Content

# The artifact is: answers.join("|") + "|" + checksum

# Step C: Submit
curl -s -X POST "https://api.litcoiin.xyz/v1/submit" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{

• Confidence: 80% confidence
• Finding: Submitting artifacts with a bearer token is normal for the protocol, but it still represents external transmission of authenticated activity data. In an automated mining context, leaked tokens or verbose logging could enable session hijacking or unwanted repeated submissions.

External Transmission

Medium

• Category: Data Exfiltration

Content

# The artifact is: answers.join("|") + "|" + checksum

# Step C: Submit
curl -s -X POST "https://api.litcoiin.xyz/v1/submit" \
  -H "Content-Type: application/json" \
  -H "Authorization: Bearer $TOKEN" \
  -d '{

• Confidence: 80% confidence
• Finding: Submitting artifacts with a bearer token is normal for the protocol, but it still represents external transmission of authenticated activity data. In an automated mining context, leaked tokens or verbose logging could enable session hijacking or unwanted repeated submissions.

External Transmission

Medium

• Category: Data Exfiltration

Content

Via API:
```bash
# List tasks
curl -s "https://api.litcoiin.xyz/v1/research/tasks"

# Submit solution
curl -s -X POST "https://api.litcoiin.xyz/v1/research/submit" \

• Confidence: 90% confidence
• Finding: Listing tasks is harmless, but the nearby research submission flow sends code and reasoning to the same external service and the static match spans that context. Given the skill's promise of permanent reasoning storage, this is a real exfiltration/privacy issue in context.

External Transmission

Medium

• Category: Data Exfiltration

Content

Via API:
```bash
# List tasks
curl -s "https://api.litcoiin.xyz/v1/research/tasks"

# Submit solution
curl -s -X POST "https://api.litcoiin.xyz/v1/research/submit" \

• Confidence: 90% confidence
• Finding: Listing tasks is harmless, but the nearby research submission flow sends code and reasoning to the same external service and the static match spans that context. Given the skill's promise of permanent reasoning storage, this is a real exfiltration/privacy issue in context.

Static analysis

No suspicious patterns detected.