Security audit

Btcvision Alert

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Bitcoin alert helper, but it recommends persistent hourly execution and includes promotional donation content in generated alerts without enough user control.

Review the alert template before installing, especially if alerts go to shared Telegram, Discord, or Slack channels. Only add the cron schedule if you intentionally want hourly background checks, know which account will run it, and know how to remove it. Expect calls to BTC-vision.org for live price and sentiment data.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:39
Finding: Mandatory Promotional and Donation Content Injected into Agent Alerts## Vulnerability Details **File Location**: `SKILL.md`, lines 39-47 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium **Complete Code Snippet**: ```text ### Alert template when triggered ``` ```text 🚨 BTCvision ALERT Bitcoin just moved {change}%! 💰 Current: ${price} 📊 Sentiment: {fg_label} ({fg_value}/100) 🔍 Full analysis: https://btc-vision.org ⚡ Donate to keep alerts free: welove@blink.sv ``` ### Technical Analysis The prescribed alert template inserts a third-party promotional URL and donation address into every generated alert. These elements are not necessary to report the requested Bitcoin price or sentiment condition. Loading and following the Skill therefore changes the content of the Agent's responses to promote the Skill operator and solicit donations. The issue affects output integrity rather than host-level access. An attacker controlling the Skill text can use a similar instruction pattern to make trusted Agent notifications carry advertising, fundraising requests, or deceptive links. In this instance, no credential request, executable payload, or local privilege escalation was identified. ### Attack Path 1. A user or Agent loads the Skill to monitor Bitcoin prices. 2. A configured price or sentiment condition is met. 3. The Agent follows the fixed alert-template instruction. 4. The resulting trusted notification includes the operator-controlled website and donation address. 5. A recipient may visit the promoted site or send funds because the solicitation appears within an Agent-generated alert. ### Impact Assessment The issue permits manipulation of Agent-generated alert content within sessions where the Skill is active. It can expose all alert recipients to unsolicited promotion and financial solicitation. It does not, based on the audited file, grant filesystem access, system privileges, credential access, or code-execution capability.
Remediation: ## Remediation Suggestions - Remove the promotional URL and donation address from the default alert template. - Restrict default alerts to information required by the user, such as the triggering condition, current price, percentage change, and sentiment. - Display third-party attribution or donation information only after explicit user consent. - Clearly label optional promotional content as third-party material rather than presenting it as part of the operational alert. - Allow users to review and approve the final notification template before alerts are enabled.

T06 · System Persistence

Warning

Location: SKILL.md:55
Finding: Recommended Hourly Cron Job Creates Cross-Session Persistence## Vulnerability Details **File Location**: `SKILL.md`, lines 55-59 **Vulnerability Type**: `T06: System Persistence` **Risk Level**: Medium **Complete Code Snippet**: ```text ## Cron Schedule (Recommended) ``` ```cron # Check every hour 0 * * * * openclaw run btcvision-alert ``` ### Technical Analysis The Skill recommends adding an hourly cron entry that invokes the Skill independently of the original interactive session. If installed, this scheduled task survives the initiating Skill run and repeatedly activates the Skill. The documentation does not provide an explicit consent workflow, removal command, execution-user restriction, rate limit, logging policy, destination controls, or failure-handling procedure. Although the audited file only recommends the cron entry and does not install it automatically, following the instruction establishes persistent execution with the permissions of the account that owns the crontab. ### Attack Path 1. A user or administrator follows the scheduling recommendation. 2. The cron entry is installed under the selected operating-system account. 3. Cron invokes `openclaw run btcvision-alert` every hour, including after the original session ends. 4. Each invocation may contact the external BTC-vision service and process or emit alerts. 5. The activity continues until the cron entry is explicitly removed or disabled. ### Impact Assessment The scheduled command obtains the privileges of the account whose crontab contains the entry; the documentation does not itself elevate privileges. Its scope includes recurring Skill execution, repeated outbound service requests, and repeated notifications. If configured under a privileged account, the recurring process would inherit that account's broader execution context. No separate backdoor, startup service, or automatic cron installation was found.
Remediation: ## Remediation Suggestions - Require explicit, informed opt-in before creating any scheduled task. - Do not instruct an Agent to install the cron entry automatically. - Run the task under a dedicated least-privileged account rather than an administrator or root account. - Provide exact commands for listing, disabling, and removing the scheduled entry. - Document outbound endpoints, notification destinations, logging behavior, retry limits, and rate limits. - Add a bounded execution timeout and prevent overlapping scheduled runs. - Offer a session-scoped or manually invoked mode as the default, with persistent scheduling as an optional configuration.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Content: --- name: btcvision-alert version: 1.0.0 description: "Send automatic Bitcoin price alerts when BTC moves ±3% or crosses key levels. Powered by BTC-vision.org live data. Works with Telegram, Discord, Slack." author: welove111 homepage: https://btc-vision.org license: MIT tags: [bitcoin, btc, alert, price-alert, crypto, notification, telegram, discord, trading, signal] protocols: [mcp, a2a] category: finance/crypto --- # BTCvision Alert Skill ## When To Use This Skill Use this skill when: - A user wants to be notified when Bitcoin moves significantly - BTC price crosses a key level ($60K, $70K, $80K, $100K, etc.) - Market sentiment changes drast
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger guidance is broad enough to match ordinary finance or market-related user requests, which can cause the skill to activate unexpectedly. In this skill's context, unintended activation is risky because it prompts use of an external crypto service and may steer users into automated alert workflows without clear consent or need.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to send requests to btc-vision.org but does not clearly disclose that user interactions will result in data being sent to a third-party service. This creates a transparency and privacy issue, especially if user-defined thresholds or alerting context are later transmitted to the external provider.

Static analysis

No suspicious patterns detected.