blink-wallet

• Outcome: Review
• Latest audit: Aug 22, 2026 · 9:13 PM UTC
• Version: 1.8.0

Overview

The wallet functions are mostly coherent, but users should review it because important real-funds and seed-based capabilities are under-disclosed in the install metadata.

Install only if you are comfortable granting an agent access to live Blink wallet operations. Use staging first, prefer read/receive-only API keys, add Write scope only when needed, configure L402 budgets and allowlists before auto-pay, avoid giving SPARK_MNEMONIC to shared agents, and clear ~/.blink token/root-key/Spark state when no longer needed.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence
• Finding: The top-level description frames the skill as a wallet/client, but the document also exposes materially broader behaviors: L402 producer/server features, external service discovery, persistent token/cache management, and root-key generation/storage. This kind of scope expansion can cause agents or operators to grant the skill more trust and permissions than intended, increasing the risk of unintended outbound requests, persistence, and spend-related actions.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The documented command set goes beyond a wallet with L402 auto-pay client behavior and adds service discovery plus L402 producer functionality. That mismatch increases attack surface and can mislead downstream systems about what the skill may do on the network and filesystem, which is especially relevant for an agent that might invoke commands autonomously.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: Server-side L402 paywall producer capabilities are substantially different from client wallet operations and require managing signing material and verification logic. Bundling them into the same skill broadens privileges and persistence requirements, creating unnecessary exposure if an agent only needed wallet functionality.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The safety policy says `l402-pay` fails closed unless budget and allowlist are configured, while later documentation says no limits are enforced if no config exists. Contradictory spending-control semantics are dangerous in a payment skill because agents may rely on the stricter statement and unintentionally permit real spending when configuration is absent or misunderstood.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The budget configuration table says the allowlist defaults to 'all allowed', but the enforcement section says `l402-pay` fails closed with no allowlist configured. For an autonomous payment feature, this ambiguity can directly affect whether third-party domains are payable by default, making the control unreliable and potentially enabling unintended outbound payments.

Context-Inappropriate Capability

Medium

• Confidence: 77% confidence
• Finding: The module creates and persists a long-lived root signing key under the user's home directory and also accepts it from an environment variable, introducing secret material management into an agent skill that may run in shared, automated, or weakly isolated environments. If the persisted file or process environment is exposed, an attacker could mint valid macaroons and impersonate the producer, undermining authorization tied to the L402 flow.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The documentation states that production is used by default, but it does not present that behavior as a prominent safety warning despite the endpoint controlling access to live wallets and real funds. In an agent wallet skill, an operator can easily omit BLINK_API_URL during setup and unintentionally send queries or payments against mainnet, causing real financial consequences.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The `get` CLI command emits the full stored macaroon and payment preimage to stdout. These are sensitive bearer-style secrets for L402 access, and printing them increases the chance of disclosure via terminal logs, shell history capture, process wrappers, CI logs, or other tooling that records stdout. In a wallet/agent context, exposing these values is more dangerous because they may be automatically consumed or logged by surrounding automation.

External Transmission

Medium

• Category: Data Exfiltration

Content

| Environment | GraphQL Endpoint | WebSocket Endpoint | Purpose |
|-------------|-----------------|--------------------|---------|
| Production | `https://api.blink.sv/graphql` | `wss://ws.blink.sv/graphql` | Live wallets, real sats |
| Staging | `https://api.staging.blink.sv/graphql` | `wss://ws.staging.blink.sv/graphql` | Signet testnet, free test sats |

The endpoint is controlled by the `BLINK_API_URL` environment variable. If unset, production is used.

• Confidence: 84% confidence
• Finding: This section documents a live production GraphQL endpoint tied to real wallets and explicitly notes that production is the default when BLINK_API_URL is unset. In the context of an autonomous wallet skill, that combination materially increases the chance of unintended transmission of payment instructions or wallet operations to a real-money environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

- `--method GET|POST|PUT|DELETE|PATCH` — HTTP method (default: GET)
- `--header key:value` — extra request header (repeatable)
- `--body <string>` — request body for POST/PUT
- `--no-store` — disable token cache (do not read or write `~/.blink/l402-tokens.json`)
- `--force` — pay even if a valid cached token exists
- `--probe` — run a fee probe (`lnInvoiceFeeProbe`) before paying to estimate routing fees; warns and continues if the probe fails; adds a `feeProbe` field to the `l402_paid` output

• Confidence: 84% confidence
• Finding: The skill persists L402 tokens containing macaroons and preimages in `~/.blink/l402-tokens.json`. Because those artifacts may function as reusable proof-of-payment credentials, insecure local storage or broad read access could let another local process replay access to paid resources or extract sensitive payment metadata.

Session Persistence

Medium

• Category: Rogue Agent

Content

}

/**
 * Write the token store to disk, creating ~/.blink/ if needed.
 *
 * @param {object} store
 */

• Confidence: 85% confidence
• Finding: The script persists L402 macaroons and preimages to a plaintext JSON file under `~/.blink`. These tokens function as reusable authentication/payment artifacts, so local compromise, backup leakage, or overly permissive filesystem access could expose them and allow unauthorized reuse. In this skill's context, session persistence is expected for usability, but storing wallet-related bearer secrets unencrypted still creates meaningful risk.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.env_credential_access, suspicious.insecure_tls_verification

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: scripts/_blink_client.js:22

HTTPS certificate verification is disabled.

Warn

• Code: suspicious.insecure_tls_verification
• Location: scripts/create_invoice_lnaddress.js:48