ClawHub
Back to skill

Security audit

Cashu

Security checks for vulnerabilities and agentic risk

Overview

This Cashu wallet skill is openly payment-focused, but it tells agents to bypass confirmations and automatically pay remote 402 requests, which creates a real risk of unintended fund transfers.

Install only if you are comfortable with an agent operating a Cashu wallet, and do not allow unattended send, pay, burn, LNURL, or 402 payment flows. Require explicit per-transaction approval, verify amount, mint, recipient, originating domain, and fees, and use a wallet with limited funds and trusted mints.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
package.json:26
Finding

Unpinned Third-Party Wallet Package Installation

Content
View full analysis
Remediation
View remediation
``` 2. Validate downloaded artifacts against approved cryptographic hashes or package signatures. 3. Record the reviewed version and authoritative package repository in the skill documentation. 4. Use an isolated environment and avoid system-wide `pip` installation. 5. Make dependency upgrades explicit and subject each new version to security review before changing the pin. 6. Consider using a constraints or lock file with hashes where the installation mechanism supports it. 7. Monitor upstream releases and package ownership changes for signs of supply-chain compromise. ]]>

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:59
Finding

Mandatory Confirmation Bypass Enables Unauthorized Automated Payments

Content
View full analysis
cashu --yes send # Example: CASHU_DIR=~/.cashu MINT_URL=https://8333.space:3338 cashu --yes send 100 ``` ```bash # Receive a token string CASHU_DIR=~/.cashu MINT_URL= cashu --yes receive ``` ```bash # Pay an invoice CASHU_DIR=~/.cashu MINT_URL= cashu --yes pay ``` ```bash # Pay an LNURL/Lightning Address (automatically resolves the invoice) CASHU_DIR=~/.cashu MINT_URL= cashu --yes pay # Example: CASHU_DIR=~/.cashu MINT_URL= cashu --yes pay user@npubx.cash 100 ``` `SKILL.md:143-171`: ```text **The flow:** 1. Make your HTTP request 2. If you get a 402 with `X-Cashu: creqA...` header, extract the payment request 3. (Optional) Decode it to check accepted mints: `cashu decode ` 4. Pay it: `cashu --yes pay ` 5. Get the token from the response 6. Retry the original request, including the token in the `X-Cashu` header ``` ```bash # 1. Initial request (returns 402) curl -s -i https://api.example.com/data # Response includes: # HTTP/1.1 402 Payment Required # X-Cashu: creqA1... # 2. Pay the payment request CASHU_DIR=~/.cashu MINT_URL= cashu --yes pay "creqA1..." # Returns a token like: cashuA... # 3. Retry with token curl -s -H "X-Cashu: cas ...[truncated 2857 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly mandates --yes for all commands, including payment-related actions, which suppresses confirmations for irreversible fund transfers. In a wallet/payment skill, this materially increases the chance of unintended spending by an autonomous agent or by prompt-influenced workflows, especially when recipients, amounts, or invoices are attacker-controlled.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The documented 402 workflow encourages automatic payment and retry behavior with no user-facing approval, spending cap, or trust validation of the remote service. This can lead to unattended spending and disclosure/reuse of payment tokens to arbitrary endpoints, making the skill particularly dangerous in agentic contexts where a malicious service can repeatedly trigger 402 responses.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

Per-command

CASHU_DIR=~/.cashu MINT_URL=https://mint.example.com cashu balance

Persistent (add to ~/.bashrc or ~/.zshrc)

export CASHU_DIR=~/.cashu export MINT_URL=https://mint.example.com

text

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 115)May include surrounding context.

Example: CASHU_DIR=~/.cashu MINT_URL= cashu --yes pay user@npubx.cash 100

text

**Create a Lightning Invoice (mint):**

```bash
# Create an invoice to receive funds into the wallet

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 154)May include surrounding context.

Example:

bash
# 1. Initial request (returns 402)
curl -s -i https://api.example.com/data

# Response includes:
# HTTP/1.1 402 Payment Required

External Transmission

Medium
Category
Data Exfiltration
Confidence
83% confidence
Finding

This example shows sending a Cashu token in the X-Cashu header to an external endpoint. While external transmission is expected in this protocol, the skill frames this as an automatic retry pattern without emphasizing token sensitivity, trust boundaries, or the risk of disclosing redeemable value to unintended or malicious services.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

Returns a token like: cashuA...

3. Retry with token

curl -s -H "X-Cashu: cashuA..." https://api.example.com/data

text

This pattern is agentic-friendly: handle 402 automatically, pay, retry — just like handling rate limits or auth redirects.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The description 'This is what you use for Bitcoin payments' is overly broad and lacks clear trigger boundaries, which can cause an agent to invoke this skill for any payment-related or Bitcoin-adjacent request. Because the skill manages ecash wallets and can send value, ambiguous activation increases the risk of unintended wallet operations or payment flows being suggested or initiated in sensitive contexts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

This manifest handles payment infrastructure and depends on wallet-related environment configuration (CASHU_DIR, MINT_URL) but provides no warning about sensitive financial context, secrets, wallet state, or the consequences of sending funds. In a cryptocurrency payment skill, omission of these warnings is more dangerous because users or downstream agents may expose wallet metadata, connect to unsafe mints, or perform irreversible payment actions without adequate caution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.