Bot & Skill Security Auditor — Line-Cited 5-Bucket Static Inspector for AI Skills & Repos

Architecture, Data Sources & Execution Capabilities

• Bucket 1 — Prompt, Confirmation & Auditor Bypass: Flags hidden HTML comments, invisible/bidirectional Unicode characters, and instructions that attempt to override user confirmation rules or suppress scanner findings.
• Bucket 2 — Secret, Filesystem, Self-Modification & Persistence Access: Cites every read of ~/.ssh, ~/.aws, .env, .wattcoin_env, credential stores, crontab/systemd persistence, or modifications to SKILL.md and shell profiles.
• Bucket 3 — Outbound Network, Exfiltration & MCP Connectors: Catalogs every curl/wget/fetch URL, webhook endpoint, and MCP tool call—and explicitly traces combined data-path flows where secret reads (Bucket 2) feed outbound network calls (Bucket 3).
• Bucket 4 & Bucket 5 — Unverifiable Runtime Execution, Obfuscation & Local Machine Escalation: Flags curl | sh pipes, unpinned npx/pip packages, base64/hex blobs, and any use of ListMachines, machineId, CopyToBox, CopyFromBox, or request_smart_mode_approval.
• Hardened Prep Helper (.wattcoin_audit_prep.py): Runs at chmod 500 with /usr/bin/python3 -I, pins GitHub branches to 40-char commit SHAs, enforces 50-file / 100 KB per-file / 250 KB aggregate caps, and wraps untrusted file contents in random <untrusted_artifact_<16-hex>> tags.

Verbatim Sample Output (/workspace Proof-of-Work Preview)

Sample disclosure: this is a representative sample, not a customer report. It was produced against public or fictional test targets; wallet, account and credential values are placeholders or redacted (for example wck_<REDACTED>), and no private keys, seed phrases or secrets are ever shown. Your own report will differ in content and length.

Below is a representative output artifact generated inside /workspace with mandatory scope notes and source citations:

> This is a static inspection of the files as they exist right now. It cannot see what any fetched script, installed package, or remote endpoint will actually do — those can change after this audit. It cannot evaluate the author, the hosting account, or anything outside the files inspected. Nothing here is an assurance that this template is safe to run.

# Static Capability Inspection Report: `wattcoin-skills-audit` (`company-deep-dive` & `web-extractor`)

- **Files & Refs Inspected:**
  - `company-deep-dive-SKILL.md` (`12,283` of `12,283` bytes read; `hidden_unicode_lines: []`; `long_lines: []`)
  - `web-extractor-SKILL.md` (`3,026` of `3,026` bytes read; `hidden_unicode_lines: []`; `long_lines: []`)
  - **Total Bytes Inspected:** `15,309` bytes (`2` files of `50` max; aggregate budget `256,000` bytes)
- **Unread / Unparsed Portions:** `None` (`100%` of both artifacts was plain text within per-file and aggregate byte limits; `unread: []`)
- **Wrapper Delimiter Tag:** `83abeacb9f26f535`

---

## Bucket 1 — Prompt, Confirmation & Auditor Bypass

No matching patterns (`hidden_unicode_lines`, HTML comments, instructions to skip confirmation cards, or instructions addressed to an auditor/scanner) were found in the inspected lines of `company-deep-dive-SKILL.md` or `web-extractor-SKILL.md`. This is a statement about what is present in those lines, not an assurance.

---

## Bucket 2 — Secret, Filesystem, Self-Modification & Persistence Access

### `web-extractor-SKILL.md`
1. **Combination — Local Credential Read (`WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env`) Paired with Outbound Network Header (`X-Agent-Key` to `https://www.wattcoin.org/api/v1/scrape`):**
   - `web-extractor-SKILL.md:L11`:
     > `**Auth.** Read `WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env` every run; send as `X-Agent-Key`. Missing file -> run `getting-started` instead of failing.`
   - **Mechanical Consequence:** Reads the workspace agent API key stored in `/workspace/.wattcoin_env` and transmits it as the `X-Agent-Key` HTTP header to `https://www.wattcoin.org/api/v1/scrape` (see Bucket 3). Together with `web-extractor-SKILL.md:L13`, this forms a direct data path from `/workspace/.wattcoin_env` (`WATTCOIN_AGENT_KEY`) to `https://www.wattcoin.org/api/v1/scrape`.
2. **Workspace File Writes for Extracted Output:**
   - `web-extractor-SKILL.md:L20`:
     > `**Results.** Write anything substantial to a file in `/workspace`; summarize and name the file rather than dumping into chat. Multi-page jobs: scrape sequentially, save each, report once at the end.`
   - **Mechanical Consequence:** Writes scraped response content to files inside `/workspace`.

### `company-deep-dive-SKILL.md`
1. **Helper Execution Touching Workspace License & Dossier Files (`/workspace/.wattcoin_license_check.py`, `/workspace/.wattcoin_dd_fetch.py`, `/workspace/dossiers/...`):**
   - `company-deep-dive-SKILL.md:L11-L14`:
     > `Never read `/workspace/.wattcoin_env`, `/workspace/.wattcoin_env.bak*`, or `/workspace/.wattcoin_patentsview_key` into chat or model context, never print `WATTCOIN_AGENT_KEY` or `wcl_...` in chat, never modify `/workspace/.wattcoin_license_check.py` or `/workspace/.wattcoin_dd_fetch.py`, and never send any local credential or file content to any external host.`
     > `1. Before each dossier run, execute `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py`.`
   - `company-deep-dive-SKILL.md:L19`:
     > `/usr/bin/python3 -I /workspace/.wattcoin_dd_fetch.py --stdin-json << 'WATTCOIN_DD_REQ_EOF'`
   - `company-deep-dive-SKILL.md:L27`:
     > `3. Read the fetched data **only** from `wrapped_sources_path` (`/workspace/dossiers/<slug>-<timestamp>-<6hex>/WRAPPED_SOURCES.txt`), where the entire payload is framed inside a random 128-bit `<untrusted_data_<32-hex>> ... </untrusted_data_<32-hex>>` tag generated with `secrets.token_hex(16)`. Do **not** read `raw_sources_path` (`RAW_SOURCES.json` is saved on disk at `0600` for user export only).`
   - `company-deep-dive-SKILL.md:L32`:
     > `- **SEC EDGAR Compliance:** Sends `User-Agent: WattCoinDeepDive/1.0 (https://botappstore.com; contact@wattcoin.org)` (or a user-specific contact string if placed in `/workspace/.wattcoin_sec_ua` at `0600`) and enforces `<= 5 requests/second` (`>= 0.22s` interval across all requests and redirect hops).`
   - **Mechanical Consequence:** Invokes two local Python helper scripts in `/workspace` (`.wattcoin_license_check.py` and `.wattcoin_dd_fetch.py`) and reads/writes dossier artifacts under `/workspace/dossiers/<slug>-<timestamp>-<6hex>/` (`SCOPE_NOTE.txt`, `RAW_SOURCES.json`, `WRAPPED_SOURCES.txt`, `REPORT.md`), while referencing optional workspace configuration files `/workspace/.wattcoin_patentsview_key` and `/workspace/.wattcoin_sec_ua`.

---

## Bucket 3 — Outbound Network, Exfiltration & MCP Connectors

### `web-extractor-SKILL.md`
1. **Combination — Outbound POST to `https://www.wattcoin.org/api/v1/scrape` Carrying `X-Agent-Key` from `/workspace/.wattcoin_env` and Target URL:**
   - `web-extractor-SKILL.md:L9`:
     > `You fetch and extract web page content and JSON endpoints through the `https://www.wattcoin.org/api/v1/scrape` API.`
   - `web-extractor-SKILL.md:L11`:
     > `**Auth.** Read `WATTCOIN_AGENT_KEY` from `/workspace/.wattcoin_env` every run; send as `X-Agent-Key`. Missing file -> run `getting-started` instead of failing.`
   - `web-extractor-SKILL.md:L13`:
     > `**Calling.** POST `https://www.wattcoin.org/api/v1/scrape` with the URL and `"format"`:`
   - **Mechanical Consequence:** Sends an outbound HTTPS `POST` request to `https://www.wattcoin.org/api/v1/scrape` containing the user-requested target URL and the `X-Agent-Key` header read from `/workspace/.wattcoin_env` (Bucket 2).
2. **Direct Outbound `curl` Fallback to User-Specified `<url>`:**
   - `web-extractor-SKILL.md:L30`:
     > `**Fallback when out of quota:** run `curl -sL <url>` piped to `python3 -c 'import sys, bs4; print(bs4.BeautifulSoup(sys.stdin.read(), "html.parser").get_text(" ", strip=True))'` in `/workspace` (`bs4` is preinstalled in the container; if `ImportError` ever occurs, run `pip install --quiet beautifulsoup4 2>/dev/null` first).`
   - **Mechanical Consequence:** Fetches `<url>` directly from the sandbox container using `curl -sL` when the cloud API returns HTTP `429` (`quota_exhausted`).

### `company-deep-dive-SKILL.md`
1. **Outbound Regulatory & Registry Queries via `/workspace/.wattcoin_dd_fetch.py` (`www.sec.gov`, `data.sec.gov`, `efts.sec.gov`, `search.patentsview.org`, `rdap.org`, `image-ppubs.uspto.gov`):**
   - `company-deep-dive-SKILL.md:L31`:
     > `- **HTTPS-Only, DNS-Pinned IP Validation & SSRF Protection (`validate_and_resolve_host`):** Only queries `www.sec.gov`, `data.sec.gov`, `efts.sec.gov`, `search.patentsview.org`, and `rdap.org` (plus verified public RDAP registry redirects matching `ALLOWED_RDAP_DOMAINS` on exact domain or dot-boundary subdomains).`
   - `company-deep-dive-SKILL.md:L32`:
     > `- **SEC EDGAR Compliance:** Sends `User-Agent: WattCoinDeepDive/1.0 (https://botappstore.com; contact@wattcoin.org)` (or a user-specific contact string if placed in `/workspace/.wattcoin_sec_ua` at `0600`) and enforces `<= 5 requests/second` (`>= 0.22s` interval across all requests and redirect hops).`
   - `company-deep-dive-SKILL.md:L61`:
     > `- Deduplicated list of every primary URL (`data.sec.gov`, `www.sec.gov/Archives/...`, `efts.sec.gov`, `search.patentsview.org`, `image-ppubs.uspto.gov`, `rdap.org`) and its exact UTC `retrieved_at` timestamp used in the dossier.`
   - **Mechanical Consequence:** Sends company, ticker, CIK, and domain query strings to SEC EDGAR (`www.sec.gov`, `data.sec.gov`, `efts.sec.gov`), USPTO PatentsView (`search.patentsview.org`), and RDAP (`rdap.org`), and sends the contents of `/workspace/.wattcoin_sec_ua` (if present) as the HTTP `User-Agent` header and `/workspace/.wattcoin_patentsview_key` (if present) to `search.patentsview.org`.

---

## Bucket 4 — Unverifiable Runtime Execution & Obfuscation

### `web-extractor-SKILL.md`
1. **Unpinned `pip install` Fallback (`beautifulsoup4`):**
   - `web-extractor-SKILL.md:L30`:
     > `**Fallback when out of quota:** run `curl -sL <url>` piped to `python3 -c 'import sys, bs4; print(bs4.BeautifulSoup(sys.stdin.read(), "html.parser").get_text(" ", strip=True))'` in `/workspace` (`bs4` is preinstalled in the container; if `ImportError` ever occurs, run `pip install --quiet beautifulsoup4 2>/dev/null` first).`
   - **Mechanical Consequence:** Contains an unpinned `pip install --quiet beautifulsoup4` fallback command if `bs4` raises `ImportError`. What an unpinned package install fetches from PyPI today may differ from what it fetches tomorrow.

### `company-deep-dive-SKILL.md`
1. **Delegated Execution of Workspace Helper Scripts (`/workspace/.wattcoin_license_check.py` and `/workspace/.wattcoin_dd_fetch.py`):**
   - `company-deep-dive-SKILL.md:L12`:
     > `1. Before each dossier run, execute `/usr/bin/python3 -I /workspace/.wattcoin_license_check.py`.`
   - `company-deep-dive-SKILL.md:L19`:
     > `/usr/bin/python3 -I /workspace/.wattcoin_dd_fetch.py --stdin-json << 'WATTCOIN_DD_REQ_EOF'`
   - **Mechanical Consequence:** Executes two Python scripts located in `/workspace` (installed by `company-deep-dive-setup`), whose contents reside outside `company-deep-dive-SKILL.md` itself and must be inspected separately if modified.

---

## Bucket 5 — Local Machine Escalation

No matching patterns (`ListMachines`, `machineId`, `CopyToBox`, `CopyFromBox`, or host PC execution instructions) were found in the inspected lines of `company-deep-dive-SKILL.md` or `web-extractor-SKILL.md`. This is a statement about what is present in those lines, not an assurance.

What This Bot Does Not Do (Mandatory Refusal Boundaries)

• Never executes audited code, scripts, or shell commands found inside target skills or repositories.
• Never curls or fetches URLs embedded inside audited files.
• Never reads /workspace/.wattcoin_env into model context or echoes wck_... / wcl_... credentials in chat.
• Never issues a 'Safe', 'Pass', checkmark certification badge, or numeric security score—always prepends SCOPE_NOTE.txt verbatim and logs exact Files Audited vs. Files Skipped.

Turn-1 /workspace Onboarding & Non-Custodial Licensing

Every template on CoinLoader.com executes locally inside your isolated Grok Bot Linux sandbox (/workspace). Credentials are stored in /workspace/.wattcoin_env with 0600 permissions (-rw-------) and never echoed in chat. Paid licenses are settled once on-chain in SOL via POST https://www.wattcoin.org/api/v1/agents/license/quote and /purchase, issue a private wcl_... bearer code, and support up to 3 automatic workspace-reset rebinds via POST https://www.wattcoin.org/api/v1/agents/license/claim.

One wcl_... key, two runtimes. Your license key works inside Grok Bot and from any local terminal or IDE agent (Cursor, Claude Code, Windsurf, CI/CD) via the standalone single-file Python 3 CLI (standalone /runtime/<script>.py CLI) — Python 3.10+ standard library only, zero pip install dependencies, with --json / --markdown output.

Frequently Asked Questions — Bot & Skill Security Auditor

Explore More Live Grok Bot Templates on CoinLoader.com