T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:274- Finding
Transaction-Capable Bankr Credentials Are Disclosed to a Third-Party Coordinator
- Content
View full analysis
- Remediation
View remediation
Security audit
Litcoin Miner
Security checks for vulnerabilities and agentic risk
Overview
This skill is a high-risk crypto and AI-mining integration that discloses much of its behavior, but it delegates powerful financial and AI credentials too broadly and uses unsafe install paths.
Review before installing. Use a fresh, tightly scoped Bankr key if possible, avoid sending reusable financial or AI-provider keys to coordinator endpoints, disable relay unless you explicitly want to serve third-party AI requests, do not submit private prompts or hidden reasoning, and avoid the curl-downloaded miner or unpinned npx/pip paths unless you can verify the exact code being run.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (5)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
references/protocol.md:25- Finding
AI Provider Credentials Enable Undisclosed Automatic Relay Work and Can Be Sent to the Coordinator
- Content
View full analysis
- Remediation
View remediation
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/protocol.md:45- Finding
Mutable Remote Python Payload Is Downloaded and Executed Without Integrity Verification
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Error
- Location
SKILL.md:57- Finding
Unpinned Python and npm Packages Execute with Access to High-Value Credentials
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:224- Finding
Internal Model Reasoning Is Automatically Exfiltrated, Permanently Retained, and Publicly Displayed
- Content
View full analysis
` tags from DeepSeek-R1, QwQ, etc.) and submits alongside verified code. Traces are stored permanently and displayed on the Research Lab. ``` ### Technical Analysis The SDK automatically captures internal model reasoning and submits it to the external coordinator. The coordinator then stores the trace permanently and displays it publicly. Reasoning output can contain more than a sanitized explanation of the submitted algorithm. Depending on the model and surrounding application context, it may reproduce user prompts, proprietary research, system instructions, file content, credentials, personal data, or other contextual information. Permanent public retention makes accidental disclosure difficult or impossible to reverse. The behavior is not required to verify whether submitted code is correct or outperforms a baseline. A concise, user-reviewed rationale would satisfy documentation needs with substantially less exposure. ### Attack Path 1. The Agent performs research using a model that emits prose or `` reasoning. 2. Sensitive context is incorporated into the model's reasoning output. 3. The SDK automatically extracts that reasoning without a separate review step. 4. The reasoning is sent ...[truncated 763 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (51)
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that chain-of-thought reasoning traces are automatically captured, submitted, stored permanently, and displayed publicly, but it does not present a clear privacy/security warning before that workflow. This can leak sensitive prompts, secrets accidentally included in reasoning, proprietary logic, or internal decision traces to an external service permanently.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The SDK is documented to automatically capture model chain-of-thought and permanently store it alongside submitted code, with no strong warning about disclosure of secrets, proprietary logic, or sensitive prompt content. Permanent archival materially increases impact because once traces are uploaded, accidental leakage may be irreversible and broadly visible.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill quickly moves into write-enabled API keys, swaps, claims, staking, vaults, and autonomous agent deployment without an explicit up-front risk warning about irreversible financial actions and credential sensitivity. Users may authorize high-impact on-chain or delegated operations before understanding that the skill can spend funds and bind to their wallet.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Referencing the Bankr API endpoint corresponds to real external credential use in a financial workflow. The skill context makes this more dangerous because the key is write-enabled and connected to wallet operations, so endpoint compromise or mishandling could lead to account abuse.
- Content
Or via direct API:
bash curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"Extract the first Base/EVM wallet address. This is the miner address.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 84% confidence
- Finding
Referencing the Bankr API endpoint corresponds to real external credential use in a financial workflow. The skill context makes this more dangerous because the key is write-enabled and connected to wallet operations, so endpoint compromise or mishandling could lead to account abuse.
- Content
Or via direct API:
bash curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"Extract the first Base/EVM wallet address. This is the miner address.
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
Or via API:
bash curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"If balance is zero, use the one-time faucet:
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
This example uses a write-capable Bankr API key to initiate a swap via an external prompt endpoint. Because it can move user funds and relies on natural-language execution, misuse, prompt ambiguity, or service compromise could trigger unintended trades with irreversible financial loss.
- Content
If user wants to buy more, use Bankr:
bash # LITCOIN token: 0x316ffb9c875f900AdCF04889E415cC86b564EBa3 curl -s -X POST https://api.bankr.bot/agent/prompt \ -H "Content-Type: application/json" \ -H "X-API-Key: $BANKR_API_KEY" \ -d '{"prompt": "swap $10 of ETH to 0x316ffb9c875f900AdCF04889E415cC86b564EBa3 on base"}'
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The Bankr signing request uses the sensitive API key to produce a wallet signature through a third-party service. In a crypto setting, delegated signing is inherently high risk because compromise or misuse can authenticate or authorize actions on behalf of the user.
- Content
md MESSAGE=$(echo "$NONCE_RESPONSE" | jq -r '.message') # Step 2: Sign via Bankr SIGN_RESPONSE=$(curl -s -X POST https://api.bankr.bot/agent/sign \ -H "Content-Type: application/json" \ -H "X-API-Key: $BANKR_API_KEY" \ -d "$(jq -n --arg msg "$MESSAGE" '{signatureType: "personal_sign", message: $msg}')")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The Bankr signing request uses the sensitive API key to produce a wallet signature through a third-party service. In a crypto setting, delegated signing is inherently high risk because compromise or misuse can authenticate or authorize actions on behalf of the user.
- Content
md MESSAGE=$(echo "$NONCE_RESPONSE" | jq -r '.message') # Step 2: Sign via Bankr SIGN_RESPONSE=$(curl -s -X POST https://api.bankr.bot/agent/sign \ -H "Content-Type: application/json" \ -H "X-API-Key: $BANKR_API_KEY" \ -d "$(jq -n --arg msg "$MESSAGE" '{signatureType: "personal_sign", message: $msg}')")
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
Submitting wallet, message, and signature to verify auth is expected but still security-relevant because it externalizes authentication material to the coordinator. If session management is weak, stolen verification outputs could enable unauthorized mining or account activity.
- Content
md SIGNATURE=$(echo "$SIGN_RESPONSE" | jq -r '.signature') # Step 3: Verify and obtain token VERIFY_RESPONSE=$(curl -s -X POST https://api.litcoiin.xyz/v1/auth/verify \ -H "Content-Type: application/json" \ -d "$(jq -n --arg miner "MINER_ADDRESS" --arg msg "$MESSAGE" --arg sig "$SIGNATURE" '{miner: $miner, message: $msg, signature: $sig}')") TOKEN=$(echo "$VERIFY_RESPONSE" | jq -r '.token')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 78% confidence
- Finding
Submitting wallet, message, and signature to verify auth is expected but still security-relevant because it externalizes authentication material to the coordinator. If session management is weak, stolen verification outputs could enable unauthorized mining or account activity.
- Content
md SIGNATURE=$(echo "$SIGN_RESPONSE" | jq -r '.signature') # Step 3: Verify and obtain token VERIFY_RESPONSE=$(curl -s -X POST https://api.litcoiin.xyz/v1/auth/verify \ -H "Content-Type: application/json" \ -d "$(jq -n --arg miner "MINER_ADDRESS" --arg msg "$MESSAGE" --arg sig "$SIGNATURE" '{miner: $miner, message: $msg, signature: $sig}')") TOKEN=$(echo "$VERIFY_RESPONSE" | jq -r '.token')
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Submitting artifacts with a bearer token is normal for the protocol, but it still represents external transmission of authenticated activity data. In an automated mining context, leaked tokens or verbose logging could enable session hijacking or unwanted repeated submissions.
- Content
md # The artifact is: answers.join("|") + "|" + checksum # Step C: Submit curl -s -X POST "https://api.litcoiin.xyz/v1/submit" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 80% confidence
- Finding
Submitting artifacts with a bearer token is normal for the protocol, but it still represents external transmission of authenticated activity data. In an automated mining context, leaked tokens or verbose logging could enable session hijacking or unwanted repeated submissions.
- Content
md # The artifact is: answers.join("|") + "|" + checksum # Step C: Submit curl -s -X POST "https://api.litcoiin.xyz/v1/submit" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer $TOKEN" \ -d '{
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Listing tasks is harmless, but the nearby research submission flow sends code and reasoning to the same external service and the static match spans that context. Given the skill's promise of permanent reasoning storage, this is a real exfiltration/privacy issue in context.
- Content
Via API:
bash # List tasks curl -s "https://api.litcoiin.xyz/v1/research/tasks" # Submit solution curl -s -X POST "https://api.litcoiin.xyz/v1/research/submit" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 90% confidence
- Finding
Listing tasks is harmless, but the nearby research submission flow sends code and reasoning to the same external service and the static match spans that context. Given the skill's promise of permanent reasoning storage, this is a real exfiltration/privacy issue in context.
- Content
Via API:
bash # List tasks curl -s "https://api.litcoiin.xyz/v1/research/tasks" # Submit solution curl -s -X POST "https://api.litcoiin.xyz/v1/research/submit" \
Static analysis
No suspicious patterns detected.