Security audit

Sats4AI

Security checks for vulnerabilities and agentic risk

Overview

This skill is coherent for paid remote AI services, but it needs Review because wallet setup uses unpinned package execution with payment credentials and limited safeguards around remote file and SMS handling.

Review this carefully before installing. Use a dedicated Lightning wallet with a small balance, strict payment limits, and revocable credentials; avoid unpinned or automatic package execution where possible; do not send confidential files, secrets, sensitive prompts, or regulated data through the remote tools; and require explicit confirmation before payments or SMS messages.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:41
Finding: Unpinned Global Wallet Package Creates a Supply-Chain Execution Risk## Vulnerability Details **File Location**: `SKILL.md`, lines 41-45 **Vulnerability Type**: Unpinned third-party dependency execution **Risk Level**: High ```bash npm install -g lightning-wallet-mcp lw register --name "my-agent" # save the API key lw deposit 10000 # fund with any wallet ``` ### Technical Analysis The documented setup installs `lightning-wallet-mcp` globally without specifying an exact version or verifying package integrity. npm installation can execute package lifecycle scripts, and a global installation makes the resulting executable available system-wide. The installed tool is subsequently used to create wallet credentials and manage deposited Lightning funds. If the package, one of its transitive dependencies, or its distribution account is compromised, attacker-controlled code could execute during installation or when the `lw` command is invoked. ### Attack Path 1. An attacker compromises the npm package, its publisher account, or a transitive dependency. 2. A malicious package version is published under the version range selected by the unpinned installation command. 3. A user follows the instructions and runs `npm install -g lightning-wallet-mcp`. 4. Malicious lifecycle or runtime code executes with the privileges of the installing user. 5. The user registers the agent and deposits Lightning funds as instructed. 6. The malicious component captures wallet credentials, changes payment destinations, or initiates unauthorized payments. ### Impact Assessment Successful exploitation could provide arbitrary code execution with the installing user's privileges. It could also expose generated wallet credentials and enable theft of deposited Lightning funds or manipulation of payment transactions. Cryptocurrency payments are generally irreversible, increasing the financial impact.
Remediation: ## Remediation Suggestions - Pin `lightning-wallet-mcp` to an exact, reviewed version. - Verify package provenance, publisher identity, signatures, and integrity hashes before installation. - Avoid global installation; run the package in an isolated environment with minimal operating-system privileges. - Review package lifecycle scripts and the complete transitive dependency tree. - Use a committed lockfile where applicable. - Configure strict wallet spending limits and keep only the minimum required balance available. - Use revocable, narrowly scoped wallet credentials and document credential-rotation procedures.

T08 · Insecure Dependencies

Error

Location: SKILL.md:54
Finding: Automatic Execution of an Unpinned Wallet Package Exposes Wallet Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 54-59 **Vulnerability Type**: Unpinned third-party dependency execution with sensitive credential access **Risk Level**: High ```json "wallet": { "command": "npx", "args": ["-y", "@getalby/mcp"], "env": { "NWC_CONNECTION_STRING": "nostr+walletconnect://YOUR_CONNECTION_STRING" } } ``` ### Technical Analysis The configuration invokes `npx -y @getalby/mcp` without pinning an exact package version. The `-y` option suppresses the interactive installation confirmation, allowing npm to download and execute the currently resolved package automatically. The launched process receives `NWC_CONNECTION_STRING`, a sensitive wallet connection credential, through its environment. Any malicious package release or compromised dependency executed through this command could read the credential directly and use the permissions granted by the associated wallet connection. ### Attack Path 1. An attacker compromises `@getalby/mcp`, its publishing account, the package distribution path, or a transitive dependency. 2. A malicious version becomes the version resolved by the unpinned `npx` invocation. 3. The MCP configuration starts the wallet server. 4. `npx -y` downloads and executes the malicious package without interactive review. 5. The process reads `NWC_CONNECTION_STRING` from its environment. 6. The attacker exfiltrates or abuses the credential to perform wallet operations allowed by its authorization scope. ### Impact Assessment Exploitation could expose the Nostr Wallet Connect credential and allow unauthorized wallet actions within its configured permissions, including unauthorized Lightning payments if payment authority is granted. Malicious package code would also execute with the local privileges of the user running the MCP server and could access other resources available to that account.
Remediation: ## Remediation Suggestions - Pin `@getalby/mcp` to an exact, independently reviewed version. - Replace automatic `npx -y` retrieval with a controlled installation process using a lockfile and verified integrity data. - Verify package provenance, publisher identity, signatures, lifecycle scripts, and transitive dependencies. - Run the wallet MCP server in a sandbox or dedicated low-privilege account. - Issue a dedicated NWC connection with minimal permissions, strict per-payment and aggregate spending limits, and a short validity period. - Do not reuse the wallet credential for unrelated services. - Monitor wallet activity and provide immediate credential-revocation and rotation procedures.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file conversion feature is presented as a simple capability without stating that uploaded files may leave the local environment and be processed on remote infrastructure. Users or agents may submit confidential documents under the assumption of local processing, causing unintended disclosure of sensitive file contents and metadata to a third party.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill advertises an SMS capability but does not warn that message content and recipient phone numbers will be transmitted to a third-party remote service and may incur variable charges. In an agent context, this can lead to unintentional disclosure of sensitive data, unauthorized outbound messaging, and unexpected spend because payment and execution are easy to trigger once wallet access is configured.

Static analysis

No suspicious patterns detected.