aperture: the L402 aware reverse proxy

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:09 PM UTC
• Version: 1.0.0

Overview

The skill matches its stated purpose, but it installs mutable unverified upstream code that will run with access to Lightning invoice credentials.

Review before installing. Prefer a pinned Aperture version, run it as an unprivileged user, keep the macaroon limited to invoice-only permissions, and use --insecure or --no-auth only for isolated local development.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/install.sh:35

Finding

Unpinned Go Dependency Allows Unreviewed Upstream Code Installation

Content

View full analysis

/dev/null; then echo "Error: Go is not installed." >&2 echo "Install Go from https://go.dev/dl/" >&2 exit 1 fi echo "Go version: $(go version | grep -oE 'go[0-9]+\.[0-9]+')" echo "" # Install aperture. echo "Installing aperture..." go install "github.com/lightninglabs/aperture/cmd/aperture${VERSION}" ``` ### Technical Analysis When no version is supplied, the installation script uses the mutable `@latest` selector. Consequently, the code installed by the Skill can change after the Skill itself has been reviewed. The script does not pin an audited Aperture release or independently verify the selected source revision or resulting binary. The repository path is consistent with the declared Aperture project, and no evidence indicates that it is currently malicious. Nevertheless, relying on a mutable upstream version creates a supply-chain trust boundary. Compromise of the upstream repository, release process, a dependency, or relevant module-distribution infrastructure could cause users to install an altered binary. The installed Aperture binary is later run with access to the configuration paths for an LND TLS certificate and invoice macaroon. These resources are necessary for the declared L402 functionality, but they increase the consequences of executing an unreviewed version. ### Attack Path 1. An attacker compromises the upstream Aperture repository, its release process, or one of the dependencies selected by the latest release. 2. The attacker publishes a newer version that contains malicious behavior. 3. A user runs `scripts/install.sh` without specifying `--version ...[truncated 1019 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: templates/docker-compose-aperture.yml:41

Finding

BusyBox Container Uses a Mutable Latest Tag Without Digest Verification

Content

View full analysis

Remediation

View remediation

``` 2. Verify the digest through the official image registry and update it only through a reviewed dependency-update process. 3. Apply container hardening controls where compatible: ```yaml read_only: true security_opt: - no-new-privileges:true cap_drop: - ALL ``` 4. Add memory, CPU, and process limits to reduce denial-of-service impact. 5. Keep the backend isolated from networks it does not require and avoid publishing its port directly to the host. 6. Consider using an internally built, minimal static backend image whose source and digest are controlled with the project. ]]>

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill documents --insecure and --no-auth options without a strong, prominent warning that they disable TLS and payment/authentication protections. In the context of a reverse proxy intended to gate paid API access, normalizing these flags can lead users to expose services without transport security or access control, especially if bound beyond localhost or reused in non-development environments.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 128)May include surrounding context.

md

### Invoice Macaroon Requirement

Aperture requires `invoice.macaroon` in the configured `macdir` to create
Lightning invoices for L402 challenges. This is **not** the same as
`admin.macaroon`. If the macaroon is missing, aperture will fail to start or
will return errors when clients request paid resources.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · scripts/setup.sh (reported line 18)May include surrounding context.

sh

NETWORK="mainnet"
PORT="8081"
INSECURE=false
NO_AUTH=false
LND_HOST="localhost:10009"
LND_TLS="$HOME/.lnd/tls.cert"
LND_MACDIR=""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup.sh (reported line 103)May include surrounding context.

sh

echo "Config:       $CONFIG_FILE"
echo ""

# Create aperture directory.
mkdir -p "$APERTURE_DIR"

# Build config.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 65% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/start.sh (reported line 66)May include surrounding context.

sh

if [ "$FOREGROUND" = true ]; then
    exec aperture --configfile="$CONFIG_FILE"
else
    nohup aperture --configfile="$CONFIG_FILE" \
        > "$LOG_FILE" 2>&1 &
    APERTURE_PID=$!
    echo "aperture started in background (PID: $APERTURE_PID)"

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This markdown file includes commands that create directories and files under /tmp and start a background HTTP server and Aperture instance. While the commands are instructional, this section does not explicitly warn users that it will write local files and launch network-accessible processes, which falls under missing user disclosure for markdown skills affecting system state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.