ClawHub
Back to skill

Security audit

Btcvision Alert

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed Bitcoin alert helper that calls an external BTC-vision endpoint and does not include executable code or hidden local access.

Install only if you want BTC price or sentiment alerts powered by btc-vision.org. Review the hourly cron suggestion before enabling it, and edit the alert template if you do not want donation text or links included in notifications.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
89% confidence
Finding
The skill's activation guidance is overly broad and can match common user intents like wanting BTC updates, market sentiment, or automation, which increases the chance the agent invokes this skill without a clearly bounded request. In practice, that can route users to an external finance/crypto data source and notification workflow more often than intended, creating unnecessary external calls and potentially amplifying unreviewed alerting behavior.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.