Bitcoin and Tether on Arkade

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:16 AM UTC
• Version: 1.0.2

Overview

This appears to be a legitimate Arkade wallet skill, but it gives an agent direct crypto wallet and payment authority with limited safety gates.

Review carefully before installing. Treat this as a hot-wallet integration: keep only small balances available to agents, require explicit human approval for every send, Lightning payment, offboard, or swap, verify address/invoice/amount/network out of band, and do not paste live private keys into prompts or command lines despite stale documentation examples.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly performs network-dependent operations against external services such as the default Arkade server, Lightning/Boltz flows, and LendaSwap, yet the manifest declares no required permissions. This creates a transparency and governance gap: an agent or platform may under-enforce review or consent for outbound connectivity in a skill that can move funds and contact remote infrastructure.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The skill exposes the underlying Wallet object and low-level inspection methods for VTXOs and boarding UTXOs, which expands capability beyond the advertised high-level payment/swap interface. In an agent setting, this increases the attack surface because other components or prompts can invoke raw wallet operations, inspect sensitive state, or bypass intended guardrails and policy checks built into the skill interface.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README instructs users to initialize a wallet with a raw private key in a command-line argument but provides no warning that this exposes highly sensitive credentials to shell history, process lists, logs, or screenshots. In an agent skill context, this is more dangerous because agents may persist command history, echo commands, or include secrets in telemetry, increasing the chance of wallet compromise and irreversible fund theft.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The README advertises send, invoice payment, onchain/offchain transfer, and swap operations without cautioning that these are real money-moving actions that may be irreversible, incur fees, or send funds to attacker-controlled destinations if parameters are wrong. In an agent integration setting, this risk is elevated because an LLM-driven agent could execute these commands from ambiguous or manipulated instructions without adequate confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The documentation instructs users to send Bitcoin, pay Lightning invoices, offboard onchain, and execute swaps without prominent warnings that these actions are irreversible, may incur fees, and can fail if addresses/invoices/chains are wrong. In a financial skill, omission of these warnings materially increases the risk of permanent fund loss through operator error or misunderstanding.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: Read-only commands such as address, balance, and informational operations implicitly create and persist a new wallet when no config exists. In an agent-integrated CLI, this can silently establish durable wallet state and a new private key without clear prior consent, causing accidental fund segregation, confusion, or unintended transaction context.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The package metadata advertises broad fund-movement capabilities across Bitcoin, Lightning, offchain transfers, and stablecoin swaps without any visible indication of activation constraints, user-confirmation requirements, or least-privilege scope. In an agent skill ecosystem, vague high-risk financial authority increases the chance that an agent may invoke money-moving actions in unintended contexts, which can directly lead to asset loss.

Session Persistence

Medium

• Category: Rogue Agent

Content

}

/**
 * Create wallet from config, auto-initializing if needed.
 */
async function createWallet() {
  let config = loadConfig();

• Confidence: 91% confidence
• Finding: The CLI persists a long-lived private key and server configuration under the user's home directory, creating durable session state for a financial wallet. Persistent wallet state is especially sensitive in agent contexts because later invocations may unknowingly act with the same identity and funds, increasing the blast radius of prompt mistakes or command confusion.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"prepublishOnly": "pnpm run build"
    },
    "dependencies": {
        "@arkade-os/sdk": "^0.3.12",
        "@arkade-os/boltz-swap": "^0.2.18"
    },
    "devDependencies": {

• Confidence: 83% confidence
• Finding: The runtime dependency uses a caret range, allowing future minor/patch releases to be installed automatically. For a financial skill, dependency drift increases supply-chain risk because a compromised or breaking upstream release could alter transaction behavior, wallet logic, or swap flows without intentional review.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

},
    "dependencies": {
        "@arkade-os/sdk": "^0.3.12",
        "@arkade-os/boltz-swap": "^0.2.18"
    },
    "devDependencies": {
        "@types/node": "^24.0.0",

• Confidence: 83% confidence
• Finding: The boltz-swap dependency is unpinned via a caret range, which permits automatic upgrades to code involved in swap operations. Because this skill handles asset conversion and transfers, supply-chain compromise or unexpected behavioral changes in this package could cause misrouting, pricing issues, or direct loss of funds.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.