Archon Lightning

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Lightning wallet helper, but it needs Review because it runs unpinned npm code after loading wallet secrets and has some inconsistent payment-verification guidance.

Install only if you are comfortable giving this skill access to your Archon wallet path, wallet passphrase, and Lightning payment authority. Before using it with funds, pin or locally install a reviewed `@didcid/keymaster` version, avoid runtime package downloads during payment operations, restrict `~/.archon.env` permissions, start with very small amounts, and be deliberate before publishing a Lightning endpoint to a DID because that metadata can be publicly discoverable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/lightning/add-lightning.sh:7

Finding

Unpinned npm Dependency Executed with Wallet Credentials

Content

View full analysis

Vulnerability Details

File Location: All shell wrappers under scripts/lightning/; representative instance: scripts/lightning/add-lightning.sh:7-9
Vulnerability Type: Unpinned third-party runtime dependency
Risk Level: High

Vulnerable Code

bash

source ~/.archon.env

npx @didcid/keymaster add-lightning "$@"

Equivalent unpinned npx @didcid/keymaster invocations appear in:

• scripts/lightning/add-lightning.sh:7-9
• scripts/lightning/lightning-balance.sh:7-9
• scripts/lightning/lightning-check.sh:8-10
• scripts/lightning/lightning-decode.sh:7-9
• scripts/lightning/lightning-invoice.sh:7-9
• scripts/lightning/lightning-pay.sh:8-15
• scripts/lightning/lightning-payments.sh:7-9
• scripts/lightning/lightning-zap.sh:8-15
• scripts/lightning/publish-lightning.sh:7-9
• scripts/lightning/unpublish-lightning.sh:7-9

The documentation also recommends direct unpinned execution at SKILL.md:407-421.

Technical Analysis

Every executable wrapper loads ~/.archon.env and then invokes @didcid/keymaster through npx without specifying an exact package version. The project contains no package manifest, committed lockfile, integrity constraint, or requirement that an audited local installation be used.

Depending on the local npm and npx state, this can cause the current registry release to be downloaded and executed. Consequently, the effective implementation may change after this skill has been reviewed. The downloaded process inherits the wrapper's environment, including sensitive variables documented as:

• ARCHON_WALLET_PATH
• ARCHON_PASSPHRASE
• ARCHON_GATEKEEPER_URL

The dependency also receives authority to perform Lightning wallet and payment operations. Although no malicious behavior was found in the reviewed repository, the externally supplied runtime implementation is outside the audited code and remains mutable.

Attack Path

1. An attacke ...[truncated 1688 chars]

Remediation

View remediation

Remediation Suggestions

1. Add a project package manifest and pin @didcid/keymaster to a reviewed exact version rather than a range.

2. Commit the generated lockfile and install dependencies with npm ci, preserving npm integrity metadata.

3. Invoke only the local audited executable, such as:

   bash

   npx --no-install @didcid/keymaster add-lightning "$@"
   

   Alternatively, call the package binary directly from node_modules/.bin.

4. Separate dependency installation from wallet operations. Do not permit package download or installation lifecycle scripts to run after wallet credentials have been loaded.

5. Verify package provenance and signatures where supported, and review dependency updates before changing the pinned version.

6. Use automated dependency scanning and lockfile-diff review in continuous integration.

7. Minimize credential exposure by supplying sensitive variables only to the already-installed runtime process and by restricting wallet-file permissions.

8. Apply the same remediation to every wrapper and to the direct npx commands documented in SKILL.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that wallet creation derives a Lightning wallet from the DID private key, but it does not prominently warn users that this couples payment capability to a highly sensitive identity secret. Reusing or exposing the DID private key now risks both identity compromise and fund loss, and users may perform the operation without understanding backup, isolation, and key-handling consequences.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README encourages publishing a Lightning service endpoint into a DID document without warning that this makes the payment endpoint more discoverable and linkable to the DID. In contexts involving AI agents, pseudonymous identities, or onion endpoints, this can reduce privacy, enable profiling or targeting, and create a durable association between identity and payment activity.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: archon-lightning
description: Lightning Network payments via Archon DIDs - create wallets, send/receive sats, verify payments, Lightning Address zaps
metadata:
  openclaw:
    requires:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The skill declares use of npx without requiring a pinned package/version, which allows whatever package resolution occurs at runtime to determine the executed code. In a wallet/payment skill that handles passphrases and payment actions, running an unexpected package version creates a meaningful supply-chain risk and could expose secrets or perform unauthorized transactions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

npx @didcid/keymaster fetches and runs code without an explicit version pin, so behavior can change over time or be influenced by a compromised upstream release. Because this skill accesses ARCHON_PASSPHRASE and wallet state, the blast radius is larger than in a non-sensitive utility skill.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file alternates between saying lightning-pay.sh automatically verifies settlement and instructing users to manually verify after using it. This inconsistency is dangerous in a financial workflow because agents may treat a returned hash or command success as sufficient proof of payment, causing business logic to unlock goods or services before settlement is certain.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The lightning-zap section says the script verifies payment automatically, but the subsequent 'What it does' list says 'you still need to verify,' creating contradictory operator guidance. In a payment skill, this can cause users or agents to either assume settlement without checking or perform logic based on inconsistent success semantics, leading to false payment confirmation or transaction handling errors.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Publishing the Lightning endpoint to a DID document is described as making the endpoint discoverable, but it does not clearly emphasize that this is public metadata and may expose service topology such as an onion or payment endpoint. That can increase targeting, correlation of identities, or privacy loss, especially when tied to long-lived DIDs and payment infrastructure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This example again instructs users to execute npx @didcid/keymaster without version pinning, creating a repeatable supply-chain execution path. In the context of Lightning payments and DID wallet operations, that could result in secret theft, altered invoices, or fraudulent payment behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The documentation shows another unpinned runtime fetch/execute path via npx @didcid/keymaster. Since this skill deals with financial operations and decrypted wallet access, unpinned execution materially increases the chance of compromise through malicious or broken upstream releases.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This unpinned npx @didcid/keymaster invocation creates the same supply-chain risk as the other instances, but here it is part of a payment flow example, making misuse especially dangerous. A compromised package could exfiltrate invoice/payment data or trigger unwanted transactions while appearing to follow documented steps.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Another example directs users to run unpinned package code through npx, which is unsafe for a skill with wallet credentials and payment history access. The repeated pattern suggests operational negligence rather than one-off oversight, and the financial context makes compromise more severe.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The instructions tell users to source ~/.archon.env, which loads sensitive wallet configuration including the passphrase, but the guidance does not strongly warn against exposing that environment through logs, shell history, child processes, or debugging output. In a wallet/payment context, leakage of ARCHON_PASSPHRASE can directly compromise the user's wallet and enable unauthorized payments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/lightning/add-lightning.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
set -euo pipefail

# add-lightning.sh - Create Lightning wallet for a DID
# Usage: ./add-lightning.sh [id]

source ~/.archon.env

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The script invokes npx @didcid/keymaster without pinning a specific package version, so execution may fetch and run whatever version is current at invocation time. In a payment-related skill that creates Lightning wallets, this creates a supply-chain risk where a compromised or malicious upstream release could execute arbitrary code, access secrets from the sourced environment, or tamper with wallet operations.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The script executes a package via npx @didcid/keymaster without pinning an exact version, which allows the resolved code to change over time and can result in execution of a newly published or compromised package version. Because this wrapper also sources ~/.archon.env before execution and is used for Lightning wallet operations, a malicious dependency update could gain access to wallet-related secrets or perform unauthorized payment actions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx @didcid/keymaster without a pinned version allows execution of whatever package version is current at runtime, which can change unexpectedly or be replaced by a compromised release. In a payment-related skill that sources local secrets from ~/.archon.env, this creates a meaningful supply-chain risk because a malicious package update could access credentials, alter payment verification behavior, or execute arbitrary code on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script sources ~/.archon.env before running the decoder, implicitly exposing all variables in that file to the invoked process without notifying the user or limiting scope. In this Lightning payments context, those variables may include wallet credentials, API tokens, or DID-related secrets, so any downstream command compromise or accidental logging could leak sensitive data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The script invokes npx @didcid/keymaster without pinning an exact package version, so execution depends on whatever version npm resolves at runtime. In a payments-related skill that also loads local secrets, a compromised upstream package, typo-squatted dependency path, or unexpected update could execute arbitrary code with access to the user's environment and wallet-related context.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/lightning/lightning-invoice.sh (reported line 4)May include surrounding context.

sh

#!/usr/bin/env bash
set -euo pipefail

# lightning-invoice.sh - Create BOLT11 invoice to receive sats
# Usage: ./lightning-invoice.sh <amount> <memo> [id]

source ~/.archon.env

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script silently sources ~/.archon.env, which may contain wallet credentials, API keys, or other secrets, without warning the user that local sensitive material will be loaded into the process environment. In combination with the unpinned npx execution, this increases the chance that secrets are exposed to untrusted code or unexpectedly used during a payment operation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

The script invokes npx @didcid/keymaster without pinning an exact package version, so execution depends on whatever version the registry resolves at runtime. In a payments-related skill, this creates a real supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could lead to arbitrary code execution while the script also loads local secrets from ~/.archon.env.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The inline documentation at L06 says the script returns a JSON object containing paymentHash, paid, and preimage. In reality, the script parses intermediate JSON internally, then emits only "✅ Payment confirmed" or "❌ Payment failed or pending", and never returns the documented JSON structure or preimage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

Sourcing ~/.archon.env executes shell content from a user-controlled file in the current process, not just static key-value configuration. In the context of a Lightning payment skill, that file is likely to contain wallet credentials or network configuration, so compromise or unexpected modification of the file could lead to code execution, secret exposure, or unauthorized payments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The script executes npx @didcid/keymaster without pinning a specific package version, so each run may fetch or resolve whatever version is currently published. In a payment script that can move Lightning funds, a compromised or malicious upstream package update could alter payment behavior, exfiltrate secrets from the sourced environment, or redirect transactions.

Content

No source excerpt is available for this finding.