ClawHub
Back to skill

Security audit

LNURL Auth

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly coherent for LNURL sign-in, but it can send login authentication artifacts over plain HTTP without an explicit opt-in.

Install only if you are comfortable using it for account sign-in and can verify the callback URL first. Prefer HTTPS LNURL-auth challenges, use dry-run before submitting, and avoid plain HTTP callbacks except for local testing where interception is not a concern.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
95% confidence
Finding
This helper accepts both http and https callback URLs and will submit the signed LNURL-auth identity response over plain HTTP if the decoded LNURL or returned challenge callback uses it. Although the private key is not transmitted, the signed k1 response and linking public key are authentication artifacts that can be intercepted, modified, or replayed depending on the relying service, enabling account linkage, login interference, or impersonation attempts on insecure networks.

Static analysis

No suspicious patterns detected.