Security audit

Litcoin Skill

Security checks for vulnerabilities and agentic risk

Overview

This skill is for crypto mining and DeFi, but it asks users to grant broad financial and AI-provider authority to third-party services with weak scoping and persistence controls.

Review carefully before installing. Use a low-value wallet, dedicated and revocable Bankr/API keys, avoid global endpoint changes, disable relay unless intentionally providing inference for others, do not submit sensitive prompts or code, avoid autonomous agents or cron without hard budgets and expiry, and prefer pinned, verified package versions.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: litcoin-miner/SKILL.md:272
Finding: Transaction-Capable Bankr Credential Disclosed to a Third-Party Coordinator
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: litcoin-miner/SKILL.md:223
Finding: AI Provider Credentials and Private Reasoning Are Exported to External Services
Content: View full analysis
` tags from DeepSeek-R1, QwQ, etc.) and submits alongside verified code. Traces are stored permanently and displayed on the Research Lab. ``` `litcoin-miner/references/protocol.md:90-95`: ```markdown **Reasoning Traces (v4.6.0+):** The SDK automatically captures the model's chain-of-thought reasoning and submits it alongside verified code. Supports `` tags (DeepSeek-R1, QwQ) and prose before code blocks. Traces are stored in the permanent archive and displayed on the Research Lab and Verify pages. This produces a unique dataset: verified reasoning paired with verified, sandbox-tested code. ``` `litcoin-miner/references/protocol.md:344-346`: ```markdown - POST /v1/agent/deploy — Deploy autonomous agent `{"strategy": "...", "bankrKey": "bk_...", "aiKey": "sk-...", "config": {...}}`. Enforces 5M LITCOIN minimum balance. - POST /v1/agent/stop — Stop agent `{"agentId": "...", "bankrKey": "bk_..."}` - POST /v1/agent/config — Update agent behavior `{"agentId": "...", "bankrKey": "bk_...", "config": {...}}` ``` ### Technical Analysis The Skill documents two distinct sensitive-data flows: 1. It automatically captures chain-of-thought and submits it with generated code for permanent storage and public d ...[truncated 2433 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: litcoin-miner/references/protocol.md:45
Finding: Mutable Remote Code and Unpinned Packages Are Installed and Executed
Content: View full analysis
Remediation: View remediation

T06 · System Persistence

Error

Location: litcoin-miner/SKILL.md:315
Finding: Persistent Autonomous Jobs Can Perform Unattended Financial Operations
Content: View full analysis
100K." ``` Or manually via the SDK in a cron job: ```python from litcoin import Agent agent = Agent(bankr_key="bk_...", ai_key="sk-...") agent.mine(rounds=10) agent.research_loop(rounds=5, delay=30) status = agent.status() if status.get("claimable", 0) > 100000: agent.claim() ``` ``` `litcoin-miner/SKILL.md:315-331`: ```markdown ### 7. Autonomous Agent (Optional) Deploy an autonomous agent that mines, stakes, vaults, and compounds on its own: ```bash curl -s -X POST "https://api.litcoiin.xyz/v1/agent/deploy" \ -H "Content-Type: application/json" \ -d '{ "strategy": "balanced", "bankrKey": "bk_YOUR_KEY", "config": { "maxBudget": 20000000, "targetTier": 2 } }' ``` ``` `litcoin-miner/references/protocol.md:345-354`: ```markdown - POST /v1/agent/stop — Stop agent `{"agentId": "...", "bankrKey": "bk_..."}` - POST /v1/agent/config — Update agent behavior `{"agentId": "...", "bankrKey": "bk_...", "config": {...}}` Agent config fields: - Boolean toggles: `mine`, `research`, `autoClaim`, `autoStake`, `openVaults`, `mintLitcredit`, `autoDefend`, `depositEscrow`, `compound` - `targetTier`: null (strategy default) or 1-4 - `maxBudget`: null (unlimited) or number — max LITCOIN deployed across staking + vaults. Agent checks before every stake, vault, defend, and compound operation. ``` ### Technical Analysis ...[truncated 2538 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (69)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The description is extremely broad and includes many high-risk financial and autonomous-agent scenarios, increasing the chance the skill is invoked for loosely related requests. In an agent ecosystem, overbroad routing can cause this skill to capture conversations involving wallets, API keys, mining, and DeFi actions even when the user did not explicitly intend those operations.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
For Hermes Agent users — set LITCOIN as your custom endpoint:

bash
# In ~/.hermes/.env OPENAI_BASE_URL=https://api.litcoiin.xyz/v1 OPENAI_API_KEY=lk_YOUR_KEY

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This section enumerates fund-affecting on-chain methods such as staking, vault creation, minting debt, collateral withdrawal, and escrow deposit without any warning about irreversible transactions, liquidation risk, approvals, or gas costs. In the context of a crypto/DeFi skill, omission of these warnings materially increases the chance of unsafe execution by users or autonomous agents.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill instructs the agent to capture and submit chain-of-thought to an external service. This is dangerous because chain-of-thought may contain secrets, intermediate policy-guarded reasoning, credentials, or sensitive user context, and externalizing it creates unnecessary leakage beyond the minimum needed to perform the task.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The protocol states that chain-of-thought reasoning is automatically captured and permanently archived, but it does not prominently warn that these traces may contain sensitive prompts, secrets, proprietary logic, or internal deliberations. Permanent submission materially increases confidentiality and privacy risk because users and agent operators may unknowingly exfiltrate data that cannot be retracted.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Automatically archiving raw reasoning traces creates a direct sensitive-data disclosure risk because model traces often echo user inputs, hidden instructions, credentials, debugging artifacts, or proprietary problem context. Storing them in a permanent archive magnifies the blast radius and makes accidental disclosure effectively irreversible.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Relay mining auto-enables third-party inference serving whenever an AI API key is configured, but the docs do not clearly foreground that other users' prompts and outputs will transit the miner's provider account. This can expose confidential third-party content, create billing abuse, and create policy/compliance issues for operators who thought the key was only for their own mining or research use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to run npx skills add tekkaadan/litcoin-skill without any version pinning or integrity mechanism. Because this skill enables financial and autonomous agent behavior, an upstream package change or dependency compromise could silently deliver malicious code or altered prompts to users at install time.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README promotes mining, staking, vaults, minting, autonomous research, and API-key-based operations but provides no warnings about financial loss, wallet risk, privacy exposure, transaction irreversibility, or local system effects. In this context, users may authorize sensitive on-chain actions or provide secrets without understanding the consequences, increasing the chance of fund loss or credential exposure.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The README references npx litcoin-mcp without a pinned version, which is risky because MCP servers typically run code locally and may gain access to agent context, files, secrets, or wallets. In a DeFi-oriented skill, an unpinned package creates a supply-chain path for attackers to introduce malicious behavior that could affect funds, API keys, or research workloads.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill tells users to reroute OpenAI-compatible traffic to api.litcoiin.xyz but gives no privacy or data-handling warning. That means prompts, conversation history, tool calls, and possibly sensitive business or personal data may be sent to an unreviewed third-party endpoint under the guise of an OpenAI-compatible configuration.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: This configuration changes the default LLM endpoint by placing a third-party base URL and API key into the user's .env, redirecting future model traffic externally. In context, that can silently affect unrelated agent activity and expose prompts, tool outputs, and sensitive context to a non-default service.
Content: Scanner excerpt · SKILL.md (reported line 76)May include surrounding context.
bash
# In ~/.hermes/.env OPENAI_BASE_URL=https://api.litcoiin.xyz/v1 OPENAI_API_KEY=lk_YOUR_KEY

External Transmission

Medium

Category: Data Exfiltration
Confidence: 89% confidence
Finding: Using hermes config set OPENAI_BASE_URL https://api.litcoiin.xyz/v1 persists a third-party endpoint into agent configuration, causing subsequent requests to be sent externally. Without warning, users may unintentionally redirect broad model traffic and leak sensitive prompts or tool data beyond the expected provider boundary.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
Or with hermes config:

bash
hermes config set OPENAI_BASE_URL https://api.litcoiin.xyz/v1 hermes config set OPENAI_API_KEY lk_YOUR_KEY

External Transmission

Medium

Category: Data Exfiltration
Confidence: 86% confidence
Finding: The generic OpenAI-compatible instructions encourage sending model traffic to api.litcoiin.xyz and mention wallet-linked authentication methods, but omit any warning about data disclosure or account-linking implications. In this skill's crypto context, prompts may also become associated with wallet identities or LITCREDIT usage patterns.
Content: Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.
text
**For any OpenAI-compatible client** (LangChain, LiteLLM, Cursor, OpenClaw): - Base URL: `https://api.litcoiin.xyz/v1` - Auth: API key (`lk_`), `X-Wallet` header + LITCREDIT balance, or free tier (5 req/hr) - Endpoints: `POST /v1/chat/completions`, `GET /v1/models` - Streaming, tools, multi-turn all supported

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill recommends scheduled autonomous mining, research, and conditional claiming via cron without warning that these are recurring networked and potentially on-chain actions. This can lead to unattended spending, repeated external API use, unintended claims, and continuous task execution if misconfigured or abused.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 93% confidence
Finding: agent.stake(tier) is documented as automatically approving tokens, which means the SDK may grant token allowances and then move funds without a separate explicit approval step. Auto-approval is dangerous in a DeFi context because users may create excessive or unintended allowances and trigger value-affecting actions with reduced friction and visibility.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
md
Task types: code_optimization, algorithm, ml_training, prompt_engineering, data_science ### Staking (4 tiers: Spark/Circuit/Core/Architect) - `agent.stake(tier)` — Stake into tier 1-4 (auto-approves tokens) - `agent.unstake()` — Unstake after lock expires - `agent.upgrade_tier(new_tier)` — Upgrade to higher tier - `agent.stake_info()` — Current tier, amount, lock status

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill instructs users to execute npx litcoin-mcp without pinning an exact package version. That allows whatever version is current on npm at execution time to run with the user's privileges, creating a supply-chain risk if a malicious or compromised release is published.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Referencing npx litcoin-mcp again without a pinned version repeats the same remote code execution and supply-chain exposure. Because npx fetches and runs code directly, users may unknowingly execute a newer compromised release than the one the author intended.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill is centered on on-chain actions affecting real funds—claims, staking, vaults, minting, and autonomous agents—yet it lacks a prominent upfront warning that transactions are irreversible and financially risky. In a crypto skill, omission of this warning materially increases the chance users authorize harmful or misunderstood wallet actions.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · litcoin-miner/SKILL.md (reported line 73)May include surrounding context.
Or via direct API:

bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"

Extract the first Base/EVM wallet address. This is the miner address.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · litcoin-miner/SKILL.md (reported line 73)May include surrounding context.
Or via direct API:

bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"

Extract the first Base/EVM wallet address. This is the miner address.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · litcoin-miner/SKILL.md (reported line 113)May include surrounding context.
Or via direct API:

bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"

Extract the first Base/EVM wallet address. This is the miner address.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · litcoin-miner/SKILL.md (reported line 133)May include surrounding context.
Or via direct API:

bash
curl -s https://api.bankr.bot/agent/me -H "X-API-Key: $BANKR_API_KEY"

Extract the first Base/EVM wallet address. This is the miner address.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.
Or via API:

bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"

If balance is zero, use the one-time faucet:

External Transmission

Medium

Category: Data Exfiltration
Confidence: 50% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · litcoin-miner/SKILL.md (reported line 93)May include surrounding context.
Or via API:

bash
curl -s "https://api.litcoiin.xyz/v1/balance?wallet=0xYOUR_WALLET"

If balance is zero, use the one-time faucet:

Static analysis

No suspicious patterns detected.