Security audit

AIBTC Bitcoin Wallet

Security checks for vulnerabilities and agentic risk

Overview

This wallet skill is not plainly malicious, but it gives agents broad fund-moving, signing, paid API, and identity automation powers with weak install pinning and some under-scoped safeguards.

Review this carefully before installing. Use a pinned, verified MCP package version instead of `@latest`, start on testnet or a low-value wallet, require explicit approval for every transfer, contract call, DeFi action, inscription, and paid API call, avoid headless auto-unlock with valuable funds, and use separate addresses if you participate in public identity or social-claim workflows.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:19
Finding: Mutable npm Package Is Downloaded and Executed During Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/pillar-wallet.md:14
Finding: Pillar Signing-Key Auto-Unlock Is Derived from an API Bearer Token
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (41)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 65)May include surrounding context.
oin L1 core workflows ├── README.md # This file └── references/ ├── pillar-wallet.md # Pillar smart wallet (passkey auth, DeFi) ├── stacks-defi.md # Stacks L2 (ALEX DEX, Zest, x402) └── troubleshooting.md # Common issues and solutions

text
### Content Hierarchy 1. **SKILL.md** - Bitcoin L1 essentials: balance, fees, send BTC, wallet management 2. **pillar-wallet.md** - sBTC smart wallet with passkey auth and Zest yield 3. **stacks-defi.md** - STX transfers, DEX swaps, lending, paid APIs 4. **troubleshooting.md** - Error resolution guide ## Local Testing To verify the skill loads correctly: 1. Install the MCP server locally: ```bash cd aibtc-mcp-server npm install && npm run build

Configure Claude Code to use local version:
json
{ "mcpServers": { "aibtc": { "command": "node", "args": ["/path/to/aibtc-mcp-server/dist/index.js"] } }

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

name: aibtc-bitcoin-wallet description: Bitcoin L1 wallet for agents - check balances, send BTC, manage UTXOs. Extends to Stacks L2 (STX, DeFi) and Pillar smart wallets (sBTC yield). license: MIT metadata: author: aibtcdev version: 1.14.2 npm: "@aibtc/mcp-server" github: https://github.com/aibtcdev/aibtc-mcp-server

AIBTC Bitcoin Wallet

A skill for managing Bitcoin L1 wallets with optional Pillar smart wallet and Stacks L2 DeFi capabilities.

Install

One-command installation:

bash
npx @aibtc/mcp-server@latest --install

For testnet:

bash
npx @aibtc/mcp-server@latest --install --testnet

Quick Start

Check Balance

Get your Bitcoin balanc

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/inscription-workflow.md (reported line 170)May include surrounding context.
base64 data)"

text
### JSON Inscription **Content Type**: `application/json` ```bash echo -n '{"type":"brc-20","tick":"ordi"}' | base64 # eyJ0eXBlIjoiYnJjLTIwIiwidGljayI6Im9yZGkifQ==

Error Cases

Insufficient Funds

Symptom: Inscribe fails with "No UTXOs available"

Solution:

Check balance with get_btc_balance

Ensure confirmed balance > total cost (from estimate)

Send more BTC to wallet if needed

Unconfirmed Commit

Symptom: Reveal fails with broadcast error

Solution:

Verify commit transaction has at least 1 confirmation

Check explorer URL from inscribe response

Wait longer if still pending

Content Mismatch

Symptom: Reveal creates different inscription than expected

Cause: Different contentType or contentBase64 used in reveal vs commit

Solution: Use exact same parameters from inscribe call when calling inscribe_reveal

Wallet Not Unlocked

Symptom: "Wallet not unlocked" error

Solution: Run `wa

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/pillar-wallet.md (reported line 48)May include surrounding context.
on.

Connection

Connect to your existing Pillar wallet:

text
"Connect my Pillar wallet"

Uses pillar_connect - opens browser, auto-connects if logged in, returns your wallet address.

Check connection status:

text
"Am I connected to Pillar?"

Uses pillar_status - shows wallet address if connected.

Sending sBTC

Send to BNS names, Pillar wallet names, or Stacks addresses:

text
"Send 10000 sats to muneeb.btc" "Send 50000 sats to my-friend wallet on Pillar" "Send 25000 sats to SP2..."

Uses pillar_send with recipient types:

bns - BNS names (alice.btc)

wallet - Pillar wallet names

address - Raw Stacks addresses (SP...)

Funding Your Wallet

Three funding methods available:

From Exchange (Coinbase, Binance, etc.)

text
"Fund my Pillar wallet from an exchange"

Uses pillar_fund with method: "exchange" - generates a deposit address.

From Leather/Xverse (BTC)

text
"Deposit BTC from my Leather wallet"

Uses pillar_fund with `method

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Critical

Category: YARA Match
Confidence: 80% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · references/stacks-defi.md (reported line 65)May include surrounding context.
deposit progress:

text
"Check my deposit status for txid abc123"

Uses sbtc_deposit_status - queries Emily API for deposit processing status.

Get Deposit Address

Get instructions for manual deposits (advanced):

text
"How do I deposit BTC for sBTC?" "Show me my sBTC deposit address"

Uses sbtc_get_deposit_info - returns deposit address when wallet is unlocked.

Transfer sBTC

Send sBTC to any Stacks address:

text
"Send 0.001 sBTC to ST1..." "Transfer 100000 sats of sBTC with high fee"

Uses sbtc_transfer - 8 decimals, amount in satoshis.

Check Balance

View sBTC holdings:

text
"What's my sBTC balance?"

Uses sbtc_get_balance.

sBTC Tool Reference

Tool Description
sbtc_deposit Deposit BTC to receive sBTC
sbtc_deposit_status Check deposit status
sbtc_get_deposit_info Get deposit address/instructions
sbtc_get_balance Check sBTC balance
sbtc_transfer Send sBTC to address
`sbtc_

Tool	Description
`sbtc_deposit`	Deposit BTC to receive sBTC
`sbtc_deposit_status`	Check deposit status
`sbtc_get_deposit_info`	Get deposit address/instructions
`sbtc_get_balance`	Check sBTC balance
`sbtc_transfer`	Send sBTC to address
`sbtc_

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill advertises arbitrary paid external API execution for inference, storage, analytics, and security endpoints, which is far outside a wallet skill's expected trust boundary. In a wallet-enabled agent, this creates a dangerous bridge from fund custody to unbounded third-party network actions, potentially enabling data exfiltration, misuse of payment rails, or interaction with hostile endpoints.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to execute an npm package with the floating tag @latest, which allows whatever version is current at install time to run on the user's machine. If the package is later compromised, typo-squatted, or a malicious release is published, users following the documentation could execute unreviewed code.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README tells users to run npx clawhub install aibtc-bitcoin-wallet without pinning an exact version of the CLI tool, so the executed code may change over time. This creates a supply-chain risk because a compromised or malicious future release of clawhub would be executed by users following these instructions.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The install command uses @latest, which pulls whatever package version is current at execution time rather than a reviewed, immutable release. In a wallet skill that can unlock wallets and move funds, a compromised or malicious future package release could immediately introduce credential theft or unauthorized transaction logic.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The testnet install command also uses @latest, creating the same supply-chain risk as the main install path. Even on testnet, users may expose wallet mnemonics, passwords, or operational trust to code that can change after publication without review.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill documents BTC transfer actions but does not clearly warn that Bitcoin transactions are irreversible and that address/amount mistakes can permanently destroy funds. In an agent context, natural-language prompting increases the chance of mis-specified recipients or misunderstood confirmation steps.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The wallet setup section describes creating, importing, and storing mnemonic-backed wallets without a prominent warning about the sensitivity of seed phrases and local wallet material. Exposure of a mnemonic or weak local handling of encrypted wallet files can lead to complete wallet compromise and theft of funds.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 79% confidence
Finding: The workflow normalizes unlocking a wallet for later transactions, implying sensitive key material may persist in session or memory across multiple agent actions. In an agent environment, longer-lived unlocked sessions increase the blast radius of prompt injection, accidental tool invocation, or host compromise.
Content: Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.
md
Before sending transactions, set up a wallet: 1. **Create new wallet**: `wallet_create` - generates encrypted BIP39 mnemonic 2. **Import existing**: `wallet_import` - import from mnemonic phrase 3. **Unlock for use**: `wallet_unlock` - required before transactions

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: The documentation acknowledges an autoApprove: true mode for paid endpoint execution, which enables autonomous spending behavior if used improperly. In a wallet-enabled agent, any feature that can authorize micropayments without an explicit per-transaction confirmation can lead to unintended charges or abuse by prompt manipulation.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
- Send inbox messages with `send_inbox_message` (use this instead of execute_x402_endpoint for inbox) - Build new x402 APIs with `scaffold_x402_endpoint` and `scaffold_x402_ai_endpoint` Always probe before executing paid endpoints. Never call `execute_x402_endpoint` with `autoApprove: true` without checking cost first. **send_inbox_message** — dedicated tool for aibtc.com inbox messages: - Parameters: `recipientBtcAddress` (bc1...), `recipientStxAddress` (SP...), `content` (max 500 chars), `paymentTxid` (optional)

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: The documentation acknowledges an autoApprove: true mode for paid endpoint execution, which enables autonomous spending behavior if used improperly. In a wallet-enabled agent, any feature that can authorize micropayments without an explicit per-transaction confirmation can lead to unintended charges or abuse by prompt manipulation.
Content: Scanner excerpt · SKILL.md (reported line 179)May include surrounding context.
md
- Send inbox messages with `send_inbox_message` (use this instead of execute_x402_endpoint for inbox) - Build new x402 APIs with `scaffold_x402_endpoint` and `scaffold_x402_ai_endpoint` Always probe before executing paid endpoints. Never call `execute_x402_endpoint` with `autoApprove: true` without checking cost first. **send_inbox_message** — dedicated tool for aibtc.com inbox messages: - Parameters: `recipientBtcAddress` (bc1...), `recipientStxAddress` (SP...), `content` (max 500 chars), `paymentTxid` (optional)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document materially expands a wallet skill into a broader identity, social-verification, reputation, and recurring activity platform workflow. In an agent-tooling context, this scope creep is dangerous because it can normalize unnecessary off-platform interactions, repeated signing, and disclosure behaviors that are unrelated to basic wallet operations, increasing the attack surface and the chance an agent performs sensitive actions without clear user intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The X/Twitter claim flow requires publishing a wallet address and claim code publicly and interacting with a third-party verification system, which is outside the expected scope of a Bitcoin wallet. In a wallet-integrated agent, this can pressure users or agents into deanonymizing wallet ownership and linking blockchain identity to social accounts, creating privacy, impersonation, and profiling risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The X/Twitter claim instructions tell users to publicly post both a claim code and wallet address but do not clearly warn that this permanently associates a blockchain address with a public social identity. That omission is especially risky in a wallet context, where privacy and address compartmentalization are core safety properties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The on-chain identity registration step instructs the agent to write identity data to a blockchain without clearly warning that the record is permanent and publicly queryable. Users may not understand that linking Bitcoin and Stacks addresses on-chain can create irreversible privacy loss and long-term traceability.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The reputation and validation workflow introduces behavior shaping and external trust scoring into a wallet skill, which is context-inappropriate and can manipulate agents into generating signed feedback or interacting with platform-controlled ranking systems. This broadens authority from asset management to social coordination and can be abused to influence agent behavior, leak metadata, or trigger unwanted transactions or attestations.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The periodic paid-attention/check-in protocol encourages continuous signed interactions with a remote service that are unrelated to core wallet functionality. In an autonomous agent setting, this creates an unnecessary persistent command channel and telemetry mechanism that can track activity, habituate frequent signing, and potentially be repurposed for social engineering or covert tasking.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs users to broadcast commit and reveal Bitcoin transactions but does not explicitly warn that these actions spend real funds and are effectively irreversible once confirmed. In an agent-wallet context, operational documentation that normalizes broadcasting without a clear spending/irreversibility warning increases the risk of unintended loss from user misunderstanding or unsafe autonomous execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document instructs agents and users how to perform irreversible wallet actions, transfers, deposits, and leveraged DeFi operations without prominent warnings about transaction finality, liquidation risk, address/recipient mistakes, bridge risk, or potential fund loss. In an agent skill context, especially where 'pillar_direct_*' tools are recommended for autonomous use, this increases the chance that an agent executes high-risk financial actions without adequate confirmation or safeguards.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The documentation presents value-transfer actions in a straightforward imperative style without corresponding warnings about irreversibility, address verification, fees, bridge risk, or borrowing/liquidation risk. In an agent setting, terse examples can normalize high-risk financial actions and increase the chance that users or orchestrators trigger them without adequate confirmation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file documents broad DeFi, smart-contract, and paid external API capabilities that materially expand beyond a wallet skill's stated purpose of balances, transfers, and UTXO management. In an agent context, scope creep is security-relevant because it increases the reachable attack surface and may cause operators or downstream systems to permit risky actions they did not expect this skill to enable.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T08 · Insecure Dependencies

T09 · Insecure Skill Coding Practices

SkillSpector

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

AIBTC Bitcoin Wallet

Install

Quick Start

Check Balance

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Error Cases

Insufficient Funds

Unconfirmed Commit

Content Mismatch

Wallet Not Unlocked

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Connection

Sending sBTC

Funding Your Wallet

From Exchange (Coinbase, Binance, etc.)

From Leather/Xverse (BTC)

YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]

Get Deposit Address

Transfer sBTC

Check Balance

sBTC Tool Reference

Context-Inappropriate Capability

Rp1

Rp1

Rp1

Rp1

Missing User Warnings

Missing User Warnings

Session Persistence

Autonomous Decision Making

Autonomous Decision Making

Description-Behavior Mismatch

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Context-Inappropriate Capability

Context-Inappropriate Capability

Missing User Warnings

Missing User Warnings

Missing User Warnings

Description-Behavior Mismatch

Static analysis