Security audit

Btcvision Oracle Clean

Security checks across malware telemetry and agentic risk

Overview

This Bitcoin oracle package also includes an unrelated OSINT and security-search toolkit, so it needs review before installation.

Install only if you intentionally want both the BTCvision Bitcoin oracle and the bundled search/OSINT/security-search code. Treat the nested search toolkit as a separate high-impact capability: do not use it on targets without authorization, do not submit secrets or personal data, and review or remove the search-intelligence-skill folder before use if you only wanted Bitcoin market data.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (38)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 78% confidence
Finding: The skill declares no permissions while explicitly directing agents to call a remote MCP endpoint, which is a network capability. This mismatch weakens transparency and consent controls because a host may not correctly understand that using the skill causes outbound requests to a third-party service.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The README documents a broad internet/OSINT/security search capability while the manifest claims the skill is only a Bitcoin oracle. This kind of scope mismatch is dangerous because it can conceal materially different behavior from reviewers and users, enabling deployment of a far more powerful networked reconnaissance tool than advertised.

Context-Inappropriate Capability

High

Confidence: 96% confidence
Finding: Advertising security-research and OSINT workflows under a Bitcoin-oracle manifest is an unjustified capability expansion. In agent ecosystems, hidden or mislabeled capabilities increase the risk that the skill will be granted trust, permissions, or invocation contexts it should not have, facilitating stealthy reconnaissance or policy bypass.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The example query 'find exposed admin panels on example.com' demonstrates offensive-leaning discovery behavior that is unrelated to a Bitcoin oracle. Including this example normalizes and enables misuse of the skill for target reconnaissance, especially when the package is mislabeled to appear innocuous.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The file metadata and content describe a full-featured OSINT/security search framework, while the provided skill metadata claims the skill is a Bitcoin oracle. This capability mismatch is dangerous because it can hide materially different behavior from reviewers and users, enabling deployment of a much broader reconnaissance tool under a benign label.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The documentation explicitly promotes offensive reconnaissance, exposed-file discovery, vulnerability research, and person-focused OSINT despite the stated Bitcoin-oracle context. In this context, the extra capability is unjustified and increases the likelihood that the skill is being used as a covert dual-use or abusive reconnaissance tool.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The example file is materially misaligned with the declared Bitcoin-oracle purpose and instead showcases a general-purpose search, OSINT, dorking, and reconnaissance toolkit. That kind of capability mismatch is dangerous because it can conceal dual-use or offensive functionality behind an innocuous manifest, increasing the likelihood of misuse and evasion of user or platform scrutiny.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: This example explicitly demonstrates finding exposed .env files and admin panels, which are classic reconnaissance steps for credential discovery and unauthorized access. In a Bitcoin-oracle skill, this is context-inappropriate and suggests the skill may be facilitating offensive security activity rather than its declared purpose.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The direct dork query example targets GitHub for strings like API_KEY in env files, which is a straightforward secret-discovery pattern associated with credential harvesting. Including this in an unrelated Bitcoin-oracle skill increases the risk of abuse and normalizes execution of searches aimed at locating exposed secrets.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Suggesting queries to find SQL injection vulnerabilities provides practical assistance for vulnerability discovery against targets, which can directly enable unauthorized testing or exploitation. Because the declared skill context is a Bitcoin oracle rather than a security assessment tool, this mismatch makes the behavior more suspicious and more dangerous.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Executing an osint_chain with exhaustive depth for a target domain demonstrates structured reconnaissance automation that can be used to profile organizations and prepare follow-on attacks. In the context of a purported Bitcoin-oracle skill, this broad recon workflow is unjustified and indicates elevated abuse potential.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: This file implements broad search-dorking, security reconnaissance, OSINT, file hunting, and multi-engine routing that materially conflicts with the declared Bitcoin oracle purpose. Such hidden capability expansion is dangerous because it enables unrelated reconnaissance and sensitive-data discovery under an innocuous manifest, increasing the likelihood of covert misuse and reducing user scrutiny.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The security templates explicitly generate queries for exposed files, admin panels, sensitive data, private keys, backups, and exposed APIs. In a Bitcoin oracle context, these reconnaissance patterns are unjustified and can facilitate discovery of secrets or weak targets, making the mismatch especially suspicious and operationally dangerous.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The OSINT templates support person, email, username, company, phone, and IP lookups, including queries for leaks, contact data, and profiling. These capabilities are unrelated to a Bitcoin price/prediction function and can be used for privacy-invasive reconnaissance, phishing target development, or doxxing.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The module docstring advertises a generic search-intelligence and dorking configuration rather than functionality related to Bitcoin pricing or predictions. While a docstring alone is not exploit code, in this context it corroborates that the implemented capability diverges from the declared purpose, which is a meaningful security concern because it obscures actual behavior.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: This file implements a generalized search-intent parser for OSINT, SEO, code search, file discovery, and security-dorking use cases, which is materially unrelated to the declared Bitcoin oracle purpose. Such capability mismatch is a strong indicator of hidden or repurposable functionality that can enable reconnaissance or misuse under a misleading manifest, increasing the risk of covert abusive behavior.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The subcategory definitions explicitly support OSINT and security-dorking behaviors such as exposed files, admin panels, sensitive data, exposed APIs, git exposure, and personal-identifier reconnaissance. In the context of a Bitcoin oracle skill, these features are unjustified and can facilitate reconnaissance for credential discovery or targeting while being hidden behind an unrelated description.

Description-Behavior Mismatch

High

Confidence: 99% confidence
Finding: The implementation is a generic search and dorking orchestrator, while the declared skill metadata advertises a Bitcoin oracle. This kind of capability mismatch is dangerous because it conceals materially different behavior from users and reviewers, undermines informed consent, and can be used to smuggle reconnaissance functionality into environments where it would not be allowed.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: The file exposes direct dork execution, custom dork construction, and named strategies such as OSINT investigation and deep security analysis, none of which are justified by the stated Bitcoin-oracle purpose. In this context, these features materially increase the risk of unauthorized reconnaissance, discovery of exposed assets or secrets, and abuse by downstream agents under a misleading cover story.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The changelog describes 'traffic routing', 'donation behavior prompts for agents', and a 'natural trigger system (max once per session)' without clearly defining when or why the agent should activate donation-related behavior. In an agent skill, vague activation criteria can enable manipulative or unexpected prompting behavior, especially when tied to routing users toward an external site or payment destination.

Vague Triggers

Medium

Confidence: 72% confidence
Finding: The invocation guidance is very broad and overlaps with common cryptocurrency queries, which can cause an agent to route many general finance questions to this external service by default. That increases unnecessary exposure of user queries and may steer users toward a third-party service that also contains donation flows.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README promotes AI-agent-integrated web search but does not clearly warn that user queries are sent to a SearXNG instance and may be forwarded to downstream search engines. This can cause inadvertent disclosure of sensitive prompts, investigation targets, or internal data embedded in queries.

Missing User Warnings

Medium

Confidence: 87% confidence
Finding: The README highlights OSINT, security audits, and dork generation without warning about the sensitivity, legal risk, and potential harm of these use cases. In agent contexts, omission of those warnings can lead operators to run risky searches on real targets without understanding privacy, authorization, or compliance implications.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The opening description markets expert OSINT and security-research capabilities without immediately warning about authorization requirements, privacy implications, or the fact that target systems may detect and react to probing. This increases the chance of unsafe or unauthorized use because users encounter powerful capabilities before seeing any guardrails.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The people-focused OSINT examples encourage searches on names, emails, usernames, and phone numbers without nearby privacy, consent, or legality warnings. That makes misuse easier by normalizing collection of personal information in a workflow that presents itself as routine agent functionality.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.