lightning
4 findings (2 critical, 2 high), mainly data exfiltration, command injection, unauthorized tool use. Most recent scan 2026-02-06.
CRITICAL RISK - This skill presents severe security risks for autonomous LLM operation. While it includes a warning about 'RECKLESS MODE', the technical implementation lacks essential safeguards for financial operations. Primary concerns: (1) Plaintext credential storage including wallet mnemonics, (2) Autonomous payment execution without mandatory confirmation, (3) Unverified external binary execution with full credential access, (4) No spending limits or rate limiting enforced in code, (5) Inadequate protection against prompt injection attacks that could trigger unauthorized payments. The skill is designed for personal use but provides insufficient technical controls to prevent misuse. The combination of autonomous LLM operation + financial transactions + weak safeguards creates unacceptable risk. Recommendation: DO NOT USE in production without implementing mandatory transaction limits, two-factor confirmation, credential encryption, and binary integrity verification. This skill requires significant security hardening before safe deployment.
Scanner's overall assessment (LLM analyzer)
Second scanner: NVIDIA SkillSpector
Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.
What this skill does
Send and receive Bitcoin Lightning payments using LNI (Lightning Node Interface). Supports LND, CLN, Phoenixd, NWC, and custodial services (Strike, Blink, Speed).
- Package
- 6 files, 42 KB
- SKILL.md
- 902 words, 12+ sections
- Code
- JavaScript (3)
SKILL.md covers: Lightning (⚡) · Supported Backends · Commands · Supported Payment Destinations · Installation · 1. Download LNI Binary · 2. Configure Backend · Tor Support (SOCKS5 Proxy) · macOS · Ubuntu/Debian · Arch · Examples
Findings
CRITICAL Hardcoded Credential Storage in User Home Directory Data Exfiltrationllm
The skill requires storing sensitive Lightning Network credentials (runes, macaroons, API keys, mnemonics, passwords) in plaintext JSON at ~/.lightning-config.json. This creates multiple critical risks: (1) Credentials stored in plaintext without encryption, (2) Macaroons and runes provide full node access, (3) Mnemonic seeds in Spark config allow complete wallet recovery and fund theft, (4) No access controls specified for the config file, (5) Credentials persist across sessions and could be accessed by other processes or malware.
SKILL.md
Create ~/.lightning-config.json with sensitive credentials including: 'rune': 'your-rune-token', 'macaroon': 'hex-encoded-admin-macaroon', 'password': 'your-phoenixd-password', 'nwcUri': 'nostr+walletconnect://...', 'apiKey': 'your-breez-api-key', 'mnemonic': 'your 12 word seed'CRITICAL Autonomous Payment Execution Without User Confirmation Data Exfiltrationllm
The skill provides a /lightning pay command that can send Bitcoin payments immediately without requiring explicit user confirmation. While there is a /lightning confirm command, the instructions do not mandate its use, and the pay command appears to execute directly. Combined with LLM autonomy, this creates risk of: (1) Unintended payments due to misunderstood instructions, (2) Social engineering attacks where attacker tricks LLM into sending funds, (3) Prompt injection causing unauthorized transfers, (4) No transaction preview or confirmation flow enforced.
SKILL.md
Command table shows: '/lightning pay <dest> [amount] - Pay (BOLT11/BOLT12/LNURL/Address)' with separate '/lightning confirm <dest> [amount] - Confirm & send payment'. Instructions do not require confirm step before pay execution.HIGH External Binary Execution Without Integrity Verification Command Injectionllm
The skill downloads and executes a prebuilt native binary (LNI) from GitHub Releases via 'npm run download' without any integrity verification. This creates supply chain attack risks: (1) No checksum/signature verification of downloaded binary, (2) Binary has full access to Lightning credentials, (3) Compromised GitHub account or release could serve malicious binary, (4) No source code review possible for prebuilt binaries, (5) Binary runs with full user privileges and credential access.
SKILL.md
Installation instructions: 'cd ~/workspace/skills/lightning\nnpm run download' - Downloads prebuilt native binary from GitHub Releases without mentioning signature verification, checksums, or integrity checks.HIGH Unrestricted Financial Tool Access Without Safeguards Unauthorized Tool Usellm
The skill provides unrestricted access to Lightning Network payment operations without implementing safety controls appropriate for autonomous LLM use. Risks include: (1) No spending limits enforced, (2) No rate limiting on payment operations, (3) No whitelist of approved payment destinations, (4) Contacts feature allows pre-saving destinations that LLM can pay without validation, (5) Multiple payment types supported (BOLT11/12, LNURL, addresses) increase attack surface, (6) History command could leak transaction patterns.
SKILL.md
Commands allow: creating invoices, paying arbitrary destinations, saving contacts, viewing history - all without documented safety controls. Warning states 'The bot can send payments on your behalf' but no technical controls enforce limits.What is in the package
| File | Kind | Size |
|---|---|---|
SKILL.md | doc | 6.4 KB |
package.json | config | 274 B |
lib/index.js | script | 323 B |
references/setup-guides.md | doc | 2.8 KB |
scripts/download-binary.js | script | 2.6 KB |
scripts/lightning.js | script | 30 KB |
External hosts referenced
github.com breez.technology files.catbox.moe pleblab.dev your-node.onion your-onion-address.onion
Hostnames that appear in the skill's files. Referencing a host is not a finding; compare against the findings above and the skill's stated purpose.
Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.
What we checked
- Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
- Behavioral analyzer. Checks what the skill asks the agent to do against what its description claims it does.
- Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
- Trigger analyzer. Looks for instructions that fire on conditions the user did not ask for.
- Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.
What we did not check
- Runtime behaviour. The skill was not executed; findings come from reading its files.
- Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
- Content the analyzers cannot read: images, binaries, and some non-English text.
- Known scanner bypass classes. See the methodology and limitations page.
Sources
- Repository: https://clawhub.ai/skills/lightning
- Raw scan result: lightning-scan.json
- Badge for your README:
- Request a re-scan