Bitcoin funding documentation matches ransomware_behavior #606

The ransomware_behavior YARA rule matches ordinary Bitcoin wallet documentation because its ransom-note expression includes send\s+.*btc with nocase, and its condition is any of them. No encryption, file modification or ransom demand is necessary for that match.

Our public Orchards skill contains two Markdown API guides and no executable scripts. Its Bitcoin-account instructions include the phrase “Send BTC” in a step explaining authorized funding of the account on the correct network. ClawHub's overall audit passes the skill, but the SkillSpector section labels this plain documentation Critical / ransomware_behavior with 80% confidence.

Public reproduction:

• Rule source: https://github.com/NVIDIA/SkillSpector/blob/main/src/skillspector/yara_rules/malware.yar.b64
• Skill audit: https://clawhub.ai/cashton-coleman/skills/orchards/security-audit
• Published API guide: https://clawhub.ai/api/v1/skills/orchards/file?path=api.md&ownerHandle=cashton-coleman&version=1.0.2
• A minimal benign input, “Send BTC on the returned network from an external wallet you control,” satisfies the current ransom-note branch.

Expected: ordinary wallet funding instructions should not be classified as ransomware solely because they describe a Bitcoin transfer. Requiring an actual ransom demand or an additional encryption/file-manipulation indicator would distinguish this case.

We have left the financial instructions intact. I am the authorized Orchards representative reporting the false positive, not an independent reviewer of Orchards or SkillSpector. I verified the matching rule and text; I have not run the complete SkillSpector pipeline locally.