alby-bitcoin-payments-cli-skill
3 findings (1 high, 2 medium), mainly data exfiltration, command injection, unauthorized tool use. Most recent scan 2026-02-05.
This bitcoin lightning wallet skill presents MODERATE TO HIGH security risks primarily related to credential management and financial operation controls. The most critical concerns are: (1) unencrypted plaintext storage of wallet connection secrets in predictable file locations, (2) credential exposure via environment variables, (3) unrestricted financial operations without transaction limits or mandatory confirmations, and (4) supply chain risks from executing unpinned external NPM packages with financial access. The skill does include positive security guidance (warning against sharing secrets, not logging credentials), but lacks technical controls to enforce these policies. The skill would benefit significantly from implementing encrypted credential storage, transaction limits, user confirmation requirements, and package integrity verification. The missing optional metadata fields (allowed-tools, compatibility) reduce transparency but are low severity informational issues. Overall, this skill requires security hardening before use in production environments with real financial assets.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
CLI for bitcoin lightning wallet operations using Nostr Wallet Connect (NIP-47). Use when the user needs to send/receive payments, check wallet balance, create invoices, convert between fiat and sats, or work with lightning addresses.
- Package
- 2 files, 3.4 KB
- SKILL.md
- 287 words, 9 sections
- Code
- None. Instructions only.
- License
- Apache-2.0
SKILL.md covers: Usage · Global Options · Connection Secret · Commands · Getting Help · Important · Helping user get a wallet · Real wallet · Test Wallet
Findings
HIGH Hardcoded Credential Storage Location Exposes Sensitive Wallet Secrets Data Exfiltrationllm
The skill instructs users to store their Nostr Wallet Connect (NWC) connection secrets in predictable, unencrypted plaintext files at ~/.alby-cli/connection-secret.key and ~/.alby-cli/connection-secret-<name>.key. These connection secrets provide full access to bitcoin lightning wallet operations including sending payments. Storing financial credentials in plaintext files without encryption, access controls, or secure key management creates a critical data exposure risk. Any process or malware with read access to the user's home directory can steal these credentials and drain the wallet.
SKILL.md
Connection Secret File Location: ~/.alby-cli/connection-secret.key and ~/.alby-cli/connection-secret-alice.key (named wallets). Instructions state 'either a file containing plaintext NWC connection secret (preferred)' indicating unencrypted storage.MEDIUM External NPM Package Execution Without Integrity Verification Command Injectionllm
The skill instructs the agent to execute 'npx @getalby/cli' which downloads and runs code from the NPM registry without any integrity checks, version pinning, or provenance verification. The npx command automatically downloads and executes the latest version of the package, creating supply chain attack risks. A compromised NPM package, typosquatting attack, or malicious package update could execute arbitrary code with access to the user's wallet credentials and file system.
SKILL.md
'npx @getalby/cli [options] <command>' - No version pinning (e.g., @getalby/cli@1.1.0), no integrity hashes, no signature verification. The package is executed directly with access to sensitive wallet operations.MEDIUM Unrestricted Financial Operations Without Transaction Limits Unauthorized Tool Usellm
The skill provides unrestricted access to wallet operations including 'pay-invoice' and 'pay-keysend' commands without any documented transaction limits, confirmation requirements, or spending controls. The instructions mention 'get-budget' command but don't enforce budget checks before payments. An agent following malicious instructions or experiencing prompt injection could authorize unlimited payments, potentially draining the entire wallet balance.
SKILL.md
Commands listed include 'pay-invoice, pay-keysend' with no mention of transaction limits, confirmation prompts, or mandatory budget checks. The 'get-budget' command exists but is not enforced as a prerequisite for payment operations.What is in the package
| File | Kind | Size |
|---|---|---|
README.md | doc | 866 B |
SKILL.md | doc | 2.6 KB |
External hosts referenced
getalby.com coinos.io github.com raw.githubusercontent.com rizful.com
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Environment variables referenced
NWC_URL
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/alby-bitcoin-payments-cli-skill
- Raw scan result: alby-bitcoin-payments-cli-skill-scan.json
- Badge for your README:
- Request a re-scan