lnd macaroon bakery

• Outcome: Pass
• Latest audit: May 28, 2026 at 11:48 AM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed LND credential-management helper that handles sensitive macaroons but does not show hidden or unrelated behavior.

Install only if you intend to manage LND macaroons. Use the narrowest role possible, avoid copying or using admin.macaroon except for tightly controlled setup, protect TLS certs and macaroon files like passwords, verify generated permissions before deployment, and run the script only with trusted lncli, jq, and Docker environments.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The remote-node section tells users to supply `--tlscertpath` and especially `--macaroonpath ~/remote-admin.macaroon` for remote operations, but it does not warn that these are highly sensitive bearer credentials whose disclosure enables privileged remote access. In this context the risk is amplified because the example explicitly references an admin macaroon and encourages copying credentials onto another machine.

VirusTotal

63/63 vendors flagged this skill as clean.