Archon Lightning

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:06 AM UTC
• Version: 0.1.0

Overview

The skill is a coherent Lightning wallet helper, but it needs Review because it runs unpinned npm code after loading wallet secrets and has some inconsistent payment-verification guidance.

Install only if you are comfortable giving this skill access to your Archon wallet path, wallet passphrase, and Lightning payment authority. Before using it with funds, pin or locally install a reviewed `@didcid/keymaster` version, avoid runtime package downloads during payment operations, restrict `~/.archon.env` permissions, start with very small amounts, and be deliberate before publishing a Lightning endpoint to a DID because that metadata can be publicly discoverable.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: scripts/lightning/add-lightning.sh:7
• Finding: Unpinned npm Dependency Executed with Wallet Credentials## Vulnerability Details **File Location**: All shell wrappers under `scripts/lightning/`; representative instance: `scripts/lightning/add-lightning.sh:7-9` **Vulnerability Type**: Unpinned third-party runtime dependency **Risk Level**: High ### Vulnerable Code ```bash source ~/.archon.env npx @didcid/keymaster add-lightning "$@" ``` Equivalent unpinned `npx @didcid/keymaster` invocations appear in: - `scripts/lightning/add-lightning.sh:7-9` - `scripts/lightning/lightning-balance.sh:7-9` - `scripts/lightning/lightning-check.sh:8-10` - `scripts/lightning/lightning-decode.sh:7-9` - `scripts/lightning/lightning-invoice.sh:7-9` - `scripts/lightning/lightning-pay.sh:8-15` - `scripts/lightning/lightning-payments.sh:7-9` - `scripts/lightning/lightning-zap.sh:8-15` - `scripts/lightning/publish-lightning.sh:7-9` - `scripts/lightning/unpublish-lightning.sh:7-9` The documentation also recommends direct unpinned execution at `SKILL.md:407-421`. ### Technical Analysis Every executable wrapper loads `~/.archon.env` and then invokes `@didcid/keymaster` through `npx` without specifying an exact package version. The project contains no package manifest, committed lockfile, integrity constraint, or requirement that an audited local installation be used. Depending on the local npm and `npx` state, this can cause the current registry release to be downloaded and executed. Consequently, the effective implementation may change after this skill has been reviewed. The downloaded process inherits the wrapper's environment, including sensitive variables documented as: - `ARCHON_WALLET_PATH` - `ARCHON_PASSPHRASE` - `ARCHON_GATEKEEPER_URL` The dependency also receives authority to perform Lightning wallet and payment operations. Although no malicious behavior was found in the reviewed repository, the externally supplied runtime implementation is outside the audited code and remains mutable. ### Attack Path 1. An attacke ...[truncated 1688 chars]
• Remediation: ## Remediation Suggestions 1. Add a project package manifest and pin `@didcid/keymaster` to a reviewed exact version rather than a range. 2. Commit the generated lockfile and install dependencies with `npm ci`, preserving npm integrity metadata. 3. Invoke only the local audited executable, such as: ```bash npx --no-install @didcid/keymaster add-lightning "$@" ``` Alternatively, call the package binary directly from `node_modules/.bin`. 4. Separate dependency installation from wallet operations. Do not permit package download or installation lifecycle scripts to run after wallet credentials have been loaded. 5. Verify package provenance and signatures where supported, and review dependency updates before changing the pinned version. 6. Use automated dependency scanning and lockfile-diff review in continuous integration. 7. Minimize credential exposure by supplying sensitive variables only to the already-installed runtime process and by restricting wallet-file permissions. 8. Apply the same remediation to every wrapper and to the direct `npx` commands documented in `SKILL.md`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (37)

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README states that wallet creation derives a Lightning wallet from the DID private key, but it does not prominently warn users that this couples payment capability to a highly sensitive identity secret. Reusing or exposing the DID private key now risks both identity compromise and fund loss, and users may perform the operation without understanding backup, isolation, and key-handling consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The README encourages publishing a Lightning service endpoint into a DID document without warning that this makes the payment endpoint more discoverable and linkable to the DID. In contexts involving AI agents, pseudonymous identities, or onion endpoints, this can reduce privacy, enable profiling or targeting, and create a durable association between identity and payment activity.

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: archon-lightning
description: Lightning Network payments via Archon DIDs - create wallets, send/receive sats, verify payments, Lightning Address zaps
metadata:
  openclaw:
    requires:

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill declares use of `npx` without requiring a pinned package/version, which allows whatever package resolution occurs at runtime to determine the executed code. In a wallet/payment skill that handles passphrases and payment actions, running an unexpected package version creates a meaningful supply-chain risk and could expose secrets or perform unauthorized transactions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: `npx @didcid/keymaster` fetches and runs code without an explicit version pin, so behavior can change over time or be influenced by a compromised upstream release. Because this skill accesses `ARCHON_PASSPHRASE` and wallet state, the blast radius is larger than in a non-sensitive utility skill.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The file alternates between saying `lightning-pay.sh` automatically verifies settlement and instructing users to manually verify after using it. This inconsistency is dangerous in a financial workflow because agents may treat a returned hash or command success as sufficient proof of payment, causing business logic to unlock goods or services before settlement is certain.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The `lightning-zap` section says the script verifies payment automatically, but the subsequent 'What it does' list says 'you still need to verify,' creating contradictory operator guidance. In a payment skill, this can cause users or agents to either assume settlement without checking or perform logic based on inconsistent success semantics, leading to false payment confirmation or transaction handling errors.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Publishing the Lightning endpoint to a DID document is described as making the endpoint discoverable, but it does not clearly emphasize that this is public metadata and may expose service topology such as an onion or payment endpoint. That can increase targeting, correlation of identities, or privacy loss, especially when tied to long-lived DIDs and payment infrastructure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This example again instructs users to execute `npx @didcid/keymaster` without version pinning, creating a repeatable supply-chain execution path. In the context of Lightning payments and DID wallet operations, that could result in secret theft, altered invoices, or fraudulent payment behavior.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The documentation shows another unpinned runtime fetch/execute path via `npx @didcid/keymaster`. Since this skill deals with financial operations and decrypted wallet access, unpinned execution materially increases the chance of compromise through malicious or broken upstream releases.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: This unpinned `npx @didcid/keymaster` invocation creates the same supply-chain risk as the other instances, but here it is part of a payment flow example, making misuse especially dangerous. A compromised package could exfiltrate invoice/payment data or trigger unwanted transactions while appearing to follow documented steps.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: Another example directs users to run unpinned package code through `npx`, which is unsafe for a skill with wallet credentials and payment history access. The repeated pattern suggests operational negligence rather than one-off oversight, and the financial context makes compromise more severe.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The instructions tell users to `source ~/.archon.env`, which loads sensitive wallet configuration including the passphrase, but the guidance does not strongly warn against exposing that environment through logs, shell history, child processes, or debugging output. In a wallet/payment context, leakage of `ARCHON_PASSPHRASE` can directly compromise the user's wallet and enable unauthorized payments.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env bash
set -euo pipefail

# add-lightning.sh - Create Lightning wallet for a DID
# Usage: ./add-lightning.sh [id]

source ~/.archon.env

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The script invokes `npx @didcid/keymaster` without pinning a specific package version, so execution may fetch and run whatever version is current at invocation time. In a payment-related skill that creates Lightning wallets, this creates a supply-chain risk where a compromised or malicious upstream release could execute arbitrary code, access secrets from the sourced environment, or tamper with wallet operations.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The script executes a package via `npx @didcid/keymaster` without pinning an exact version, which allows the resolved code to change over time and can result in execution of a newly published or compromised package version. Because this wrapper also sources `~/.archon.env` before execution and is used for Lightning wallet operations, a malicious dependency update could gain access to wallet-related secrets or perform unauthorized payment actions.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: Using `npx @didcid/keymaster` without a pinned version allows execution of whatever package version is current at runtime, which can change unexpectedly or be replaced by a compromised release. In a payment-related skill that sources local secrets from `~/.archon.env`, this creates a meaningful supply-chain risk because a malicious package update could access credentials, alter payment verification behavior, or execute arbitrary code on the host.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script sources `~/.archon.env` before running the decoder, implicitly exposing all variables in that file to the invoked process without notifying the user or limiting scope. In this Lightning payments context, those variables may include wallet credentials, API tokens, or DID-related secrets, so any downstream command compromise or accidental logging could leak sensitive data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence
• Finding: The script invokes `npx @didcid/keymaster` without pinning an exact package version, so execution depends on whatever version npm resolves at runtime. In a payments-related skill that also loads local secrets, a compromised upstream package, typo-squatted dependency path, or unexpected update could execute arbitrary code with access to the user's environment and wallet-related context.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env bash
set -euo pipefail

# lightning-invoice.sh - Create BOLT11 invoice to receive sats
# Usage: ./lightning-invoice.sh <amount> <memo> [id]

source ~/.archon.env

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script silently sources `~/.archon.env`, which may contain wallet credentials, API keys, or other secrets, without warning the user that local sensitive material will be loaded into the process environment. In combination with the unpinned `npx` execution, this increases the chance that secrets are exposed to untrusted code or unexpectedly used during a payment operation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence
• Finding: The script invokes `npx @didcid/keymaster` without pinning an exact package version, so execution depends on whatever version the registry resolves at runtime. In a payments-related skill, this creates a real supply-chain risk: a compromised publisher account, malicious update, or dependency hijack could lead to arbitrary code execution while the script also loads local secrets from `~/.archon.env`.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The inline documentation at L06 says the script returns a JSON object containing paymentHash, paid, and preimage. In reality, the script parses intermediate JSON internally, then emits only "✅ Payment confirmed" or "❌ Payment failed or pending", and never returns the documented JSON structure or preimage.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: Sourcing `~/.archon.env` executes shell content from a user-controlled file in the current process, not just static key-value configuration. In the context of a Lightning payment skill, that file is likely to contain wallet credentials or network configuration, so compromise or unexpected modification of the file could lead to code execution, secret exposure, or unauthorized payments.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence
• Finding: The script executes `npx @didcid/keymaster` without pinning a specific package version, so each run may fetch or resolve whatever version is currently published. In a payment script that can move Lightning funds, a compromised or malicious upstream package update could alter payment behavior, exfiltrate secrets from the sourced environment, or redirect transactions.

Static analysis

No suspicious patterns detected.