LNBits Wallet wtih QR Code

• Outcome: Pass
• Latest audit: Jul 10, 2026 · 4:33 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed LNbits wallet helper with real financial authority, but its behavior matches its stated wallet-management purpose and includes payment-confirmation instructions.

Install only if you are comfortable giving the assistant access to an LNbits admin key. Use a dedicated low-balance wallet, verify decoded invoice details before confirming payment, keep the adminkey out of chat and shared logs, and set LNBITS_BASE_URL to the LNbits server you intend to use.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 97% confidence
• Finding: The skill invokes Python scripts that use environment secrets, shell execution, filesystem access, and network access, but it does not declare permissions for those capabilities. This weakens sandboxing and user trust because a host may grant or deny access based on declared permissions, while the skill still handles sensitive wallet operations and secrets such as LNbits API keys.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence
• Finding: The declared description says the skill manages balance, payments, and invoices, but the instructions also allow wallet creation, invoice decoding, and QR/image file generation. This mismatch can mislead reviewers and users about the true attack surface, especially because wallet creation exposes new credentials in terminal output and file generation/network activity expand the skill beyond its stated purpose.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The skill metadata says it manages balance, pay, and invoice operations, but the code also creates new LNbits wallets/accounts. This hidden capability expands the privilege and action surface beyond what a user or orchestrator may expect, increasing the risk of unauthorized account creation or misuse of the connected LNbits instance.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest presents wallet management features, but the code also offers standalone QR generation with arbitrary output paths and local file creation. That broader file-writing behavior is not disclosed and can surprise the caller, especially in an agent setting where file-system side effects may be sensitive or policy-controlled.

Missing User Warnings

High

• Confidence: 94% confidence
• Finding: The pay command triggers an outbound Lightning payment immediately from a supplied BOLT11 invoice with no explicit confirmation, amount preview, or destination verification in the client. In an agent context this is dangerous because prompt injection, user misunderstanding, or invoice substitution could directly cause irreversible fund transfer.

Missing User Warnings

Medium

• Confidence: 80% confidence
• Finding: Wallet creation performs a real remote state-changing action but the capability is not clearly disclosed by the skill description and there is no extra authorization step. In an agent-driven environment, undisclosed network-side account creation can violate least surprise, create unmanaged resources, or be abused for spam/provisioning on the LNbits service.

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.