lnd macaroon bakery
Analysis
This is a coherent Lightning node macaroon-management helper, but it handles powerful lnd credentials and creates persistent bearer tokens that should be reviewed carefully before use.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
"uri:/lnrpc.Lightning/SendPaymentSync" ... "uri:/lnrpc.Lightning/OpenChannelSync" ... "uri:/signrpc.Signer/SignOutputRaw"
The preset roles include permissions that can enable payment, channel-management, and signing capabilities. This is aligned with the skill's purpose, but the impact is high if the wrong role is granted.
elif ! command -v lncli &>/dev/null; then ... "${LNCLI_CMD[@]}" listpermissions | jq -rThe script depends on external tools such as lncli and jq, and optionally Docker, while the registry metadata lists no required binaries.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
You need lncli installed locally and copies of the node's TLS cert and a macaroon with `macaroon:generate` permission (typically admin.macaroon).
The skill explicitly uses lnd authentication material, including an admin or macaroon-generation-capable macaroon, to create new credentials.