T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:197- Finding
Wallet Passphrase and Seed Mnemonic Stored in Plaintext Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Lightning Agentic Commerce
Security checks for vulnerabilities and agentic risk
Overview
This skill is coherent for Lightning payments, but it guides agents through real fund handling while documenting plaintext wallet secrets and insecure paywall setup.
Review carefully before installing or using with value at risk. Treat this as suitable only for isolated testnet or intentionally small funded wallets unless you replace plaintext seed/passphrase storage with stronger secret handling, avoid --insecure for exposed endpoints, and require explicit user approval before any payment-capable command runs.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:104- Finding
Insecure Aperture Configuration Recommended for Externally Accessible Paid Endpoints
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)
YARA rule 'ransomware_behavior': Ransomware-like patterns (mass encryption, ransom notes) [malware]
Critical
- Category
- YARA Match
- Confidence
- 80% confidence
- Finding
YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
- Content
tall.sh
text ### Step 2: Set Up the Lightning Node ```bash # Start litd container (testnet by default) skills/lnd/scripts/start-lnd.sh # Create an encrypted wallet skills/lnd/scripts/create-wallet.sh --mode standalone # Verify node is running skills/lnd/scripts/lncli.sh getinfoStep 3: Fund the Wallet
bash # Generate a Bitcoin address skills/lnd/scripts/lncli.sh newaddress p2tr # Send BTC to this address from an exchange or another wallet # Verify balance skills/lnd/scripts/lncli.sh walletbalanceStep 4: Open a Channel
bash # Connect to a well-connected node (e.g., ACINQ, Bitfinex) skills/lnd/scripts/lncli.sh connect <pubkey>@<host>:9735 # Open a channel skills/lnd/scripts/lncli.sh openchannel --node_key=<pubkey> --local_amt=1000000 # Wait for channel to confirm (6 blocks) skills/lnd/scripts/lncli.sh listchannelsStep 5: Configure lnget
bash # Initialize lnget config (auto-detects local lnd) lnget config init # Verify connection lnget ln s
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 92% confidence
- Finding
The documentation states that the wallet passphrase and seed mnemonic are stored in plaintext files under the user's home directory, even if mode 0600 is applied. On a compromised host, through backups, logs, accidental file disclosure, or local privilege abuse, these files can enable complete wallet compromise and theft of funds.
- Content
md | Component | Security Model | |-----------|---------------| | **Wallet passphrase** | Stored at `~/.lnget/lnd/wallet-password.txt` (0600) | | **Seed mnemonic** | Stored at `~/.lnget/lnd/seed.txt` (0600) | | **L402 tokens** | Stored at `~/.lnget/tokens/<domain>/` per domain | | **lnd macaroons** | Standard lnd paths at `~/.lnd/data/chain/...` |
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill includes commands that can trigger real Lightning payments (
lnget --max-cost ...) but does not place an explicit warning adjacent to those commands that they may spend real funds if pointed at a live wallet or mainnet-connected node. In an agentic context, examples are often copied verbatim, so missing spending warnings increases the chance of unintended payment execution.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Fetch an L402-protected resource lnget --max-cost 1000 https://api.example.com/paid-data # Preview without paying lnget --no-pay https://api.example.com/paid-data
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Fetch an L402-protected resource lnget --max-cost 1000 https://api.example.com/paid-data # Preview without paying lnget --no-pay https://api.example.com/paid-data
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Fetch an L402-protected resource lnget --max-cost 1000 https://api.example.com/paid-data # Preview without paying lnget --no-pay https://api.example.com/paid-data
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 50% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # Fetch an L402-protected resource lnget --max-cost 1000 https://api.example.com/paid-data # Preview without paying lnget --no-pay https://api.example.com/paid-data
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The seller setup instructs users to run
skills/aperture/scripts/setup.sh --port 8081 --insecurewithout a nearby explanation of what protections are disabled or the exposure created. Using an insecure reverse-proxy/paywall configuration can allow interception, credential/token leakage, or unsafe public exposure of the paid endpoint.- Content
Static analysis
No suspicious patterns detected.