ClawHub
Back to skill

Security audit

Litcoin

Security checks for vulnerabilities and agentic risk

Overview

This crypto/DeFi skill is coherent with its stated purpose, but it asks for high-impact wallet and AI credentials and documents defaults that can spend funds, grant approvals, serve third-party AI traffic, and publish model reasoning.

Review carefully before installing. Use only a low-balance, dedicated wallet and narrowly limited or revocable API keys; avoid using valuable wallets or primary AI-provider keys. Disable relay mode unless you intentionally want to serve third-party inference traffic, do not include secrets in prompts or research context, verify package versions and source before running pip/npx/curl commands, and inspect or revoke token allowances after staking, vault, repayment, or escrow actions.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)

other

Error
Location
references/protocol.md:83
Finding

Automatic Collection and Permanent Publication of Model Reasoning Traces

Content
View full analysis
` tags (DeepSeek-R1, QwQ) and prose before code blocks. Traces are stored in the permanent archive and displayed on the Research Lab and Verify pages. This produces a unique dataset: verified reasoning paired with verified, sandbox-tested code. ``` ### Technical Analysis The documented SDK automatically captures model reasoning and submits it to the external LITCOIN coordinator. The submitted traces are then stored permanently and displayed on public-facing Research Lab and Verify pages. Reasoning traces can contain more than the final research result. Depending on the surrounding agent context, they may include: - User-supplied confidential information - Proprietary research methods or source code - System or developer instructions - Internal file names and environment details - Credentials or tokens inadvertently included in model context - Unpublished intellectual property Submission of verified code and benchmark results may be necessary for research mining, but collection and permanent publication of the model's entire reasoning process are not necessary for code verification. Automatic collection therefore exceeds minimum privilege and data-minimization requirements. ### Attack Path 1. A user configures the SDK for research mining. 2. The model receives a research task along with potentially sensitive contextual information. 3. The model generates code and an associated reasoning trace. 4. The SDK automatically extracts the reasoning trace without requiring per-submission approval. 5. The trace is transmitted to the external coordinator. 6. The coordinator s ...[truncated 746 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/protocol.md:343
Finding

Transmission of High-Privilege Wallet and AI Provider Credentials to a Third-Party Coordinator

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/protocol.md:118
Finding

AI Provider Credential Automatically Enables Third-Party Relay Workloads

Content
View full analysis
Remediation
View remediation

T03 · Remote Payload Retrieval and Execution

Error
Location
references/protocol.md:44
Finding

Execution of Mutable, Unpinned Remote Packages and Downloaded Scripts

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (22)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The quick-start examples immediately call methods like faucet(), mine(), claim(), staking, vault, and escrow functions without a prominent warning that these can execute real on-chain transactions, consume gas, move funds, or lock collateral. In a crypto/DeFi skill, omission of that warning materially raises the risk of unintended financial actions by users or downstream agents.

Content

No source excerpt is available for this finding.

Ssd 3

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The protocol documents automatic capture and permanent archival of model chain-of-thought reasoning traces submitted alongside research code. These traces can contain secrets, proprietary prompts, personal data, or internal reasoning that should not be stored indefinitely or shared, making the data exposure risk significant.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation description is very broad and covers generic crypto, DeFi, and AI-agent tasks, increasing the chance the skill is invoked in situations the user did not specifically intend. In this skill, accidental invocation is more dangerous because the examples and APIs can trigger real wallet-connected, on-chain, and fund-affecting operations.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
84% confidence
Finding

The skill instructs users to send prompts and API keys to third-party endpoints such as https://api.venice.ai/api/v1, which constitutes external transmission of potentially sensitive data. In context, research mining may involve user prompts, generated code, metadata, or credentials being sent off-platform, creating confidentiality and governance risks if users are not clearly warned.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md
agent = Agent(
    bankr_key="bk_YOUR_KEY",
    ai_key="sk-YOUR_KEY",           # Venice, OpenAI, Groq, or use Bankr LLM (see below)
    ai_url="https://api.venice.ai/api/v1",
    model="llama-3.3-70b",
)

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Documenting stake(tier) as auto-approves indicates the SDK may automatically approve token allowances as part of a financial transaction flow. Auto-approval reduces user scrutiny over authorization scope and can grant spending permissions that outlive the immediate action, which is particularly risky in a wallet-connected DeFi context.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md
- `research_history(task_id)` — Your submissions

### Staking
- `stake(tier)` — Stake tier 1-4 (auto-approves)
- `unstake()` — Unstake after lock expires
- `early_unstake(confirm)` — Preview/execute early unstake with penalty
- `upgrade_tier(new_tier)` — Upgrade to higher tier

Rp1

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

The skill references an MCP server via npx litcoin-mcp without pinning an exact package version. That makes installs non-deterministic and exposes users to supply-chain risk if a future package version is compromised, typo-squatted, or changed to include malicious behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 29)May include surrounding context.

md
agent = Agent(
    bankr_key="bk_YOUR_KEY",        # Bankr API key (get one at bankr.bot/api)
    ai_key="sk-YOUR_KEY",           # AI provider key (enables relay + research mining)
    ai_url="https://api.venice.ai/api/v1",
    model="llama-3.3-70b",
)

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 418)May include surrounding context.

md
agent = Agent(
    bankr_key="bk_YOUR_KEY",        # Bankr API key (get one at bankr.bot/api)
    ai_key="sk-YOUR_KEY",           # AI provider key (enables relay + research mining)
    ai_url="https://api.venice.ai/api/v1",
    model="llama-3.3-70b",
)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The protocol states that supplying an AI API key enables relay behavior and also describes automatic capture/submission of reasoning traces, but does not present a strong upfront privacy warning. In this context, users may unknowingly allow third-party prompts, model outputs, or sensitive reasoning content to be processed and retained externally.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The documentation says providing an AI API key automatically turns the miner into a relay provider serving other users' inference requests. In an agent skill, this is especially risky because users may believe the key is only for their own mining or research tasks, not for handling external traffic with privacy, billing, and abuse implications.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 146)May include surrounding context.

The LITCOIN compute marketplace works as a drop-in OpenAI replacement:

bash
curl https://api.litcoiin.xyz/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: lk_YOUR_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 146)May include surrounding context.

The LITCOIN compute marketplace works as a drop-in OpenAI replacement:

bash
curl https://api.litcoiin.xyz/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: lk_YOUR_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 271)May include surrounding context.

The LITCOIN compute marketplace works as a drop-in OpenAI replacement:

bash
curl https://api.litcoiin.xyz/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: lk_YOUR_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 274)May include surrounding context.

The LITCOIN compute marketplace works as a drop-in OpenAI replacement:

bash
curl https://api.litcoiin.xyz/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: lk_YOUR_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 279)May include surrounding context.

The LITCOIN compute marketplace works as a drop-in OpenAI replacement:

bash
curl https://api.litcoiin.xyz/v1/chat/completions \
  -H "Content-Type: application/json" \
  -H "X-Api-Key: lk_YOUR_KEY" \
  -d '{

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/protocol.md (reported line 271)May include surrounding context.

bash
# Get a challenge
curl https://api.litcoiin.xyz/v1/benchmark/challenge

# Submit result
curl -X POST https://api.litcoiin.xyz/v1/benchmark/submit \

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The SDK documentation advertises staking operations that auto-approve token allowances. In a DeFi skill, automatic approvals increase the blast radius of mistakes or contract compromise because users may grant spending permissions without a distinct review step.

Content

Scanner excerpt · references/protocol.md (reported line 453)May include surrounding context.

md
### Staking

- `agent.stake(tier)` — Stake LITCOIN into a tier (1-4). Auto-approves.
- `agent.upgrade_tier(new_tier)` — Upgrade to higher tier.
- `agent.unstake()` — Unstake (lock period must be expired).
- `agent.tier()` — Current tier (0=none, 1=Spark, 2=Circuit, 3=Core, 4=Architect).

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Automatically approving token allowances during vault opening can silently authorize contract spending as part of a high-risk financial operation. Because the skill manages collateralized debt positions, hidden or overly broad approvals can directly endanger user funds if contracts are flawed or upgraded maliciously.

Content

Scanner excerpt · references/protocol.md (reported line 466)May include surrounding context.

md
### Vaults

- `agent.open_vault(collateral)` — Open vault with LITCOIN collateral. Auto-approves.
- `agent.add_collateral(vault_id, amount)` — Add more collateral.
- `agent.mint_litcredit(vault_id, amount)` — Mint LITCREDIT against vault.
- `agent.repay_debt(vault_id, amount)` — Repay LITCREDIT debt. Auto-approves.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

Auto-approving during debt repayment similarly changes token permissions without a dedicated consent step. In a protocol with upgradeable contracts and automated agent workflows, silent approvals can be abused or persist longer than users realize.

Content

Scanner excerpt · references/protocol.md (reported line 469)May include surrounding context.

md
- `agent.open_vault(collateral)` — Open vault with LITCOIN collateral. Auto-approves.
- `agent.add_collateral(vault_id, amount)` — Add more collateral.
- `agent.mint_litcredit(vault_id, amount)` — Mint LITCREDIT against vault.
- `agent.repay_debt(vault_id, amount)` — Repay LITCREDIT debt. Auto-approves.
- `agent.withdraw_collateral(vault_id, amount)` — Withdraw collateral.
- `agent.close_vault(vault_id)` — Close vault (must repay all debt first).
- `agent.vault_ids()` — List of vault IDs for this wallet.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
89% confidence
Finding

The escrow deposit flow also auto-approves token transfers, which is risky in an autonomous compute marketplace tied to spending balances over time. Users may unknowingly combine allowance grants with subsequent automated spending behavior, increasing exposure to loss if the escrow contract or workflow is compromised.

Content

Scanner excerpt · references/protocol.md (reported line 483)May include surrounding context.

md
### Escrow (Compute Marketplace)

- `agent.deposit_escrow(amount)` — Deposit LITCREDIT for compute. Auto-approves.
- `agent.request_withdraw_escrow(amount)` — Request withdrawal (15-min delay).
- `agent.cancel_withdraw_escrow()` — Cancel pending withdrawal.
- `agent.complete_withdraw_escrow()` — Complete withdrawal after delay.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The documentation instructs users to install a skill via npx skills add tekkaadan/litcoin-skill without pinning an exact version or integrity hash. This exposes users to supply-chain risk because a later compromised or malicious package update could be fetched and executed automatically in a high-trust agent environment.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The MCP installation instructions use npx -y litcoin-mcp without pinning a specific version. Because npx will fetch and run the current published package, users may execute unintended code if the package is updated maliciously or the publisher account is compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.