Lightning Security Module

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:11 PM UTC
• Version: 1.0.0

Overview

This skill is Review because it sets up a legitimate Lightning remote signer but uses high-risk defaults for credentials, secrets, network exposure, and dependency installation.

Install only after reviewing and changing the defaults: use a signer-scoped macaroon instead of admin.macaroon, avoid copy-paste/base64 transfer of privileged credentials, protect or avoid plaintext seed and password files, bind REST/RPC to private interfaces or a VPN/firewall, and pin/verify Docker images or source commits before using this with real funds.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/export-credentials.sh:220
• Finding: Unrestricted Admin Macaroon Is Exported to the Less-Trusted Agent Machine<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export-credentials.sh:220-249` **Additional Locations**: `SKILL.md:127-136`, `SKILL.md:203-218`, `references/architecture.md:59-63` **Vulnerability Type**: Excessive credential privileges and violation of least privilege **Risk Level**: Critical ### Vulnerable Code ```bash # Copy admin macaroon. if [ -n "$RPCSERVER" ]; then # Remote mode: use the provided --macaroonpath as the bundle macaroon. if [ -z "$MACAROONPATH" ]; then echo "Error: --macaroonpath required for remote export (needed for bundle)." >&2 exit 1 fi cp "$MACAROONPATH" "$BUNDLE_DIR/admin.macaroon" elif [ -n "$CONTAINER" ]; then MACAROON="$LND_SIGNER_DIR/data/chain/bitcoin/$NETWORK/admin.macaroon" docker cp "$CONTAINER:$MACAROON" "$BUNDLE_DIR/admin.macaroon" 2>/dev/null if [ ! -f "$BUNDLE_DIR/admin.macaroon" ]; then echo "Error: Admin macaroon not found at $MACAROON in container '$CONTAINER'" >&2 exit 1 fi else MACAROON="$LND_SIGNER_DIR/data/chain/bitcoin/$NETWORK/admin.macaroon" if [ ! -f "$MACAROON" ]; then echo "Error: Admin macaroon not found at $MACAROON" >&2 exit 1 fi cp "$MACAROON" "$BUNDLE_DIR/admin.macaroon" fi echo " admin.macaroon copied." echo "" # Create portable base64-encoded tar.gz bundle. BUNDLE_ARCHIVE="$LNGET_SIGNER_DIR/credentials-bundle.tar.gz.b64" echo "Creating portable bundle..." tar -czf - -C "$BUNDLE_DIR" accounts.json tls.cert admin.macaroon | base64 > "$BUNDLE_ARCHIVE" ``` ### Technical Analysis The Skill's legitimate requirement is to authorize the watch-only node to invoke a limited set of remote-signing and key-derivation operations. Instead, the default workflow copies the signer's unrestricted `admin.macaroon` and transfers it to the agent machine. An LND admin macaroon authorizes substantially more RPC operations than the signing workflow requires. Transferring it across the signer trust boundary ther ...[truncated 1471 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bake a dedicated signer macaroon during setup and export that credential instead of `admin.macaroon`. 2. Grant only the RPC permissions actually required by the watch-only node, such as the reviewed Signer and WalletKit methods documented by the project. 3. Make least-privilege macaroon generation the default and fail closed if it cannot be completed. 4. Require an explicit option such as `--allow-admin-macaroon` for exceptional development use, accompanied by a prominent warning and confirmation. 5. Name the exported file according to its actual role, such as `signer-only.macaroon`. 6. Rotate any admin macaroon that has already been transferred to an agent machine. 7. Add automated tests that inspect the baked macaroon permissions and reject administrative permissions not required by the remote-signing protocol. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: templates/docker-compose-signer.yml:22
• Finding: Signer RPC and Wallet-Management REST Services Are Published on All Host Interfaces<![CDATA[ ## Vulnerability Details **File Location**: `templates/docker-compose-signer.yml:22-30` **Additional Location**: `templates/signer-lnd-example.toml:17-27` **Vulnerability Type**: Excessive network exposure of a key-holding service **Risk Level**: High ### Vulnerable Code ```yaml services: signer: image: ${LND_IMAGE:-lightninglabs/lnd}:${LND_VERSION:-v0.20.0-beta} container_name: litd-signer restart: unless-stopped entrypoint: ["/bin/sh", "-c", "touch /root/.lnd/wallet-password.txt && cp /tmp/lnd.conf /root/.lnd/lnd.conf && exec lnd"] ports: # RPC for watch-only node connections. - "${SIGNER_RPC_PORT:-10012}:10012" # REST for wallet creation and management. - "${SIGNER_REST_PORT:-10013}:10013" ``` The corresponding signer configuration is: ```ini # RPC on all interfaces so watch-only node can connect. rpclisten=0.0.0.0:10012 # REST on all interfaces for Docker port mapping. restlisten=0.0.0.0:10013 # Auto-unlock wallet on startup using stored passphrase. wallet-unlock-password-file=/root/.lnd/wallet-password.txt wallet-unlock-allow-create=true # TLS: allow connections from any IP (watch-only on different machine). tlsextraip=0.0.0.0 ``` ### Technical Analysis A Docker Compose port declaration without an explicit host address publishes the port on all available host interfaces. Consequently, both the signer gRPC service and the wallet-management REST service are exposed beyond the Docker network by default. Remote gRPC access is part of the declared functionality, but unrestricted host-wide publication is not the minimum necessary access. REST is used during wallet setup and does not need to remain externally reachable during ordinary signing operations. The configuration also leaves wallet creation enabled. TLS protects transport confidentiality and server authentication, but it does not eliminate risks from unnecessary service exposure, vulnerable endpoints, initialization-state APIs, stolen ma ...[truncated 1235 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bind REST exclusively to loopback: ```yaml ports: - "127.0.0.1:${SIGNER_REST_PORT:-10013}:10013" ``` 2. Bind RPC to an explicitly configured private or VPN address rather than every host interface: ```yaml ports: - "${SIGNER_BIND_IP:?Set a private signer address}:${SIGNER_RPC_PORT:-10012}:10012" ``` 3. Prefer a private Docker network, WireGuard, Tailscale, SSH tunnel, or mutually authenticated private network for remote signer communication. 4. Add host-firewall rules permitting RPC connections only from the watch-only node's fixed address. 5. Disable wallet creation after successful initialization and stop publishing REST when setup is complete. 6. Separate setup and runtime Compose profiles so the REST port exists only in a short-lived initialization profile. 7. Document that public Internet exposure is unsupported and add startup checks that reject public or wildcard bind addresses unless explicitly overridden. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/export-credentials.sh:127
• Finding: Base64 Credential Archive Can Be Created with World-Readable Permissions<![CDATA[ ## Vulnerability Details **File Location**: `scripts/export-credentials.sh:127-163,246-249` **Vulnerability Type**: Insecure permissions on a sensitive credential archive **Risk Level**: High ### Vulnerable Code ```bash BUNDLE_DIR="${OUTPUT_DIR:-$LNGET_SIGNER_DIR/credentials-bundle}" echo "=== Exporting Credentials Bundle ===" echo "" echo "Network: $NETWORK" if [ -n "$CONTAINER" ]; then echo "Container: $CONTAINER" elif [ -n "$RPCSERVER" ]; then echo "Remote: $RPCSERVER" else echo "Signer dir: $LND_SIGNER_DIR" fi echo "Output: $BUNDLE_DIR" echo "" # Verify lncli is available. if [ -n "$CONTAINER" ]; then if ! docker exec "$CONTAINER" which lncli &>/dev/null; then echo "Error: lncli not found in container '$CONTAINER'." >&2 exit 1 fi elif [ -z "$RPCSERVER" ]; then if ! command -v lncli &>/dev/null; then echo "Error: lncli not found. Run install.sh first." >&2 exit 1 fi else if ! command -v lncli &>/dev/null; then echo "Error: lncli not found. Install lncli to connect to the remote signer." >&2 exit 1 fi fi # Create bundle directory. mkdir -p "$BUNDLE_DIR" chmod 700 "$BUNDLE_DIR" ``` The sensitive archive is subsequently written without setting a restrictive mode: ```bash # Create portable base64-encoded tar.gz bundle. BUNDLE_ARCHIVE="$LNGET_SIGNER_DIR/credentials-bundle.tar.gz.b64" echo "Creating portable bundle..." tar -czf - -C "$BUNDLE_DIR" accounts.json tls.cert admin.macaroon | base64 > "$BUNDLE_ARCHIVE" ``` ### Technical Analysis The script restricts `credentials-bundle/` to mode `0700`, but it does not set a restrictive process umask, explicitly protect the parent directory, or apply mode `0600` to `credentials-bundle.tar.gz.b64`. When `export-credentials.sh` is invoked independently and the parent hierarchy does not already exist, `mkdir -p "$BUNDLE_DIR"` can create parent directories according to the user's umask. Under a common `022` umas ...[truncated 1213 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive umask before creating any files: ```bash umask 077 ``` 2. Explicitly create and protect the parent directory: ```bash mkdir -p "$LNGET_SIGNER_DIR" chmod 700 "$LNGET_SIGNER_DIR" ``` 3. Create the archive through a secure temporary file and atomically rename it: ```bash tmp_archive=$(mktemp "$LNGET_SIGNER_DIR/.credentials-bundle.XXXXXX") tar -czf - -C "$BUNDLE_DIR" accounts.json tls.cert signer-only.macaroon | base64 > "$tmp_archive" chmod 600 "$tmp_archive" mv -f "$tmp_archive" "$BUNDLE_ARCHIVE" ``` 4. Explicitly apply `chmod 600` to every credential file and archive. 5. Remove obsolete archives before rotation and provide a secure cleanup command. 6. Consider encrypting the transfer bundle to a specific recipient with age, GPG, or another authenticated encryption mechanism instead of relying on base64. ]]>

T08 · Insecure Dependencies

Error

• Location: scripts/install.sh:81
• Finding: Signer Dependencies Are Retrieved and Executed Without Immutable Verification<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:81-104,160-170` **Additional Location**: `templates/docker-compose-signer.yml:22` **Vulnerability Type**: Mutable and unverified third-party dependency installation **Risk Level**: High ### Vulnerable Code Source installation clones the remote repository and may select a mutable tag or repository state: ```bash # Use LND_VERSION from versions.env if no --version given. SOURCE_VERSION="${VERSION:-${LND_VERSION:-}}" # Clone lnd into a temp directory and build from source. TMPDIR=$(mktemp -d) trap "rm -rf $TMPDIR" EXIT echo "Cloning lnd..." git clone --quiet https://github.com/lightningnetwork/lnd.git "$TMPDIR/lnd" cd "$TMPDIR/lnd" # Checkout specific version if requested, otherwise use latest tag. if [ -n "$SOURCE_VERSION" ]; then echo "Checking out $SOURCE_VERSION..." git checkout --quiet "$SOURCE_VERSION" else LATEST_TAG=$(git describe --tags --abbrev=0 2>/dev/null || echo "") if [ -n "$LATEST_TAG" ]; then echo "Using latest tag: $LATEST_TAG" git checkout --quiet "$LATEST_TAG" else echo "Using HEAD (no tags found)." fi fi ``` Docker installation pulls and executes a tag without digest verification: ```bash IMAGE="${LND_IMAGE:-lightninglabs/lnd}" TAG="${VERSION:-${LND_VERSION:-v0.20.0-beta}}" echo "Image: $IMAGE:$TAG" echo "" # Pull the image. echo "Pulling image..." docker pull "$IMAGE:$TAG" echo "" # Verify the image works. echo "Verifying installation..." docker run --rm "$IMAGE:$TAG" lnd --version 2>/dev/null || true ``` ### Technical Analysis Git tags and Docker image tags are references rather than immutable content identities. The source workflow does not verify a commit hash, signed tag, source checksum, or release signature. If no version is provided externally, it selects the latest available tag or even repository `HEAD`. The Docker workflow uses an image tag and immediately executes the downloaded image. It does no ...[truncated 1345 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin source builds to an audited full Git commit hash rather than a tag or latest release. 2. Verify the commit's signed release provenance or a trusted maintainer signature before building. 3. Pin Docker images by immutable digest: ```yaml image: lightninglabs/lnd@sha256:<reviewed-digest> ``` 4. Store the expected commit, image digest, and release checksums inside the audited project rather than relying exclusively on an optional external `versions.env`. 5. Fail closed when immutable version metadata is missing. 6. Verify downloaded release artifacts using published checksums and signatures. 7. Generate and retain an SBOM and build provenance record for signer deployments. 8. Do not run an image merely to test its version until its digest and provenance have been validated. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence

Findings (29)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The documentation normalizes exporting and packaging an admin macaroon credential bundle and supports direct remote RPC export, while presenting the skill primarily as a protective isolation mechanism. That description-behavior gap is dangerous because users may trust the skill as hardening-focused while it also facilitates movement of highly privileged credentials between machines.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documentation normalizes exporting and packaging an admin macaroon credential bundle and supports direct remote RPC export, while presenting the skill primarily as a protective isolation mechanism. That description-behavior gap is dangerous because users may trust the skill as hardening-focused while it also facilitates movement of highly privileged credentials between machines.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documentation normalizes exporting and packaging an admin macaroon credential bundle and supports direct remote RPC export, while presenting the skill primarily as a protective isolation mechanism. That description-behavior gap is dangerous because users may trust the skill as hardening-focused while it also facilitates movement of highly privileged credentials between machines.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The documentation normalizes exporting and packaging an admin macaroon credential bundle and supports direct remote RPC export, while presenting the skill primarily as a protective isolation mechanism. That description-behavior gap is dangerous because users may trust the skill as hardening-focused while it also facilitates movement of highly privileged credentials between machines.

Credential Access

High

• Category: Privilege Escalation

Content

| Path | Purpose |
|------|---------|
| `~/.lnget/signer/wallet-password.txt` | Signer wallet passphrase (0600) |
| `~/.lnget/signer/seed.txt` | Signer seed mnemonic (0600) |
| `~/.lnget/signer/credentials-bundle/` | Exported credentials |
| `~/.lnget/signer/signer-lnd.conf` | Signer config (native mode) |

• Confidence: 98% confidence
• Finding: The skill documents storage of the wallet password and 24-word seed in plaintext files under the user's home directory. Even with 0600 permissions, plaintext seed and passphrase files materially increase the chance of theft through local compromise, backups, logs, malware, agent overreach, or accidental disclosure, directly enabling full fund compromise.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: Bundling a full admin macaroon and promoting copy/paste transfer creates a portable bearer token that can be reused by any recipient with access to the file or base64 blob. In the context of a skill advertised as firewalling private key material for watch-only nodes, this is especially dangerous because it preserves a high-privilege control channel to the signer despite key isolation.

Credential Access

High

• Category: Privilege Escalation

Content

#   setup-signer.sh --native --password "mypass" # Custom passphrase
#
# Stores credentials at:
#   ~/.lnget/signer/wallet-password.txt           (mode 0600)
#   ~/.lnget/signer/seed.txt                      (mode 0600)
#   ~/.lnget/signer/credentials-bundle/           (exported credentials)

• Confidence: 88% confidence
• Finding: The script documentation explicitly states that the wallet password and seed mnemonic are stored on disk in plaintext. Even with restrictive filesystem permissions, persistent plaintext storage of the signer seed and passphrase creates a high-value target: any local compromise, backup leakage, or accidental file exposure can result in full wallet takeover.

Credential Access

High

• Category: Privilege Escalation

Content

mkdir -p "$LND_SIGNER_DIR"
fi

PASSWORD_FILE="$LNGET_SIGNER_DIR/wallet-password.txt"
SEED_OUTPUT="$LNGET_SIGNER_DIR/seed.txt"
CONF_FILE="$LNGET_SIGNER_DIR/signer-lnd.conf"

• Confidence: 92% confidence
• Finding: This line defines host-side file paths used to persist the wallet password and seed material. In the context of a remote signer whose purpose is isolating private key material, creating predictable plaintext credential locations materially increases the risk that malware, another local user, or automated backup/sync tooling can exfiltrate the secrets.

Credential Access

High

• Category: Privilege Escalation

Content

# Copy password file into container if applicable.
if [ -n "$CONTAINER" ]; then
    docker cp "$PASSWORD_FILE" "$CONTAINER:/root/.lnd/wallet-password.txt"
    echo "Password file copied into container."
fi

• Confidence: 94% confidence
• Finding: Copying the wallet password file into the container duplicates sensitive secret material and expands the attack surface. Any compromise of the container, container filesystem inspection, docker daemon access, or accidental image/debug artifact leakage could expose the wallet passphrase needed to unlock signer-controlled funds.

Credential Access

High

• Category: Privilege Escalation

Content

image: ${LND_IMAGE:-lightninglabs/lnd}:${LND_VERSION:-v0.20.0-beta}
    container_name: litd-signer
    restart: unless-stopped
    entrypoint: ["/bin/sh", "-c", "touch /root/.lnd/wallet-password.txt && cp /tmp/lnd.conf /root/.lnd/lnd.conf && exec lnd"]
    ports:
      # RPC for watch-only node connections.
      - "${SIGNER_RPC_PORT:-10012}:10012"

• Confidence: 94% confidence
• Finding: The entrypoint creates /root/.lnd/wallet-password.txt inside the persistent signer data volume before starting lnd. Even if initially empty, this establishes a predictable credential file path in a volume that also stores sensitive wallet state, increasing the risk that later automation, operators, backups, or co-tenant access will populate, discover, or misuse wallet secrets from disk.

Credential Access

High

• Category: Privilege Escalation

Content

restlisten=0.0.0.0:10013

# Auto-unlock wallet on startup using stored passphrase.
wallet-unlock-password-file=/root/.lnd/wallet-password.txt
wallet-unlock-allow-create=true

# TLS: allow connections from any IP (watch-only on different machine).

• Confidence: 95% confidence
• Finding: The configuration enables automatic wallet unlock using a password file stored on disk, which creates a durable local secret that can be stolen by anyone who gains filesystem, container, backup, or image access. In the context of a remote signer that protects private keys, storing the unlock credential alongside the signer materially weakens the isolation goal because compromise of the host/container can lead directly to wallet access and signing capability.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill explicitly instructs users to run multiple shell scripts that install software, start containers, export credentials, and manage services, yet it declares no tool scope or allowed-tools. In an agent ecosystem, missing tool restrictions weakens governance and makes it easier for the skill to trigger powerful shell operations without clear sandbox expectations or user consent boundaries.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to copy a credentials bundle that includes an admin macaroon and TLS certificate, and even offers a base64 blob for easy transfer, without a strong warning that this is highly sensitive privileged material. In this context, the bundle can give the recipient authenticated administrative RPC access to the signer, undermining the security boundary the skill claims to create.

Session Persistence

Medium

• Category: Rogue Agent

Content

# 6. Start litd in watch-only mode
skills/lnd/scripts/start-lnd.sh --watchonly

# 7. Create watch-only wallet
skills/lnd/scripts/create-wallet.sh

# 8. Check status

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation states that the signer REST service is exposed on 0.0.0.0:10013, and the ports table also lists it on 0.0.0.0, without emphasizing the attack-surface implications. Exposing wallet-related or signer management interfaces broadly on the network can allow unauthorized probing or exploitation if authentication, TLS, or firewalling is misconfigured.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script explicitly copies an admin macaroon into an export bundle and instructs users to transfer it to another machine, granting far more than watch-only visibility. An admin macaroon typically confers broad control over the node, so this defeats the stated security boundary of isolating sensitive capabilities away from the agent host.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 75% confidence
• Finding: Docker image references without a specific tag (:latest is implicit) or digest (@sha256:...) can be silently replaced by a malicious image.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The script pulls a Docker image by mutable tag from a value that can come from versions.env or user input, without digest pinning or signature verification. Tags can be retargeted or the upstream registry/account could be compromised, causing installation of an unexpected or malicious signer image on a host intended to protect private key material.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 84% confidence
• Finding: The docker run itself is using the same unpinned image that was pulled by mutable tag, so the verification step executes code from an image whose contents are not immutably fixed. In this skill's context, that is more dangerous because the host is meant to isolate Lightning signing keys; running a substituted image undermines that trust boundary and could expose sensitive material or backdoor the signer environment.

Session Persistence

Medium

• Category: Rogue Agent

Content

#!/usr/bin/env bash
# Set up a remote signer: create wallet, export credentials bundle.
#
# Container mode (default — auto-detects litd-signer container):
#   setup-signer.sh                              # Auto-detect container

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Create directories with restricted permissions.
mkdir -p "$LNGET_SIGNER_DIR"
chmod 700 "$LNGET_SIGNER_DIR"

if [ "$NATIVE" = true ]; then
    mkdir -p "$LND_SIGNER_DIR"

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Create directories with restricted permissions.
mkdir -p "$LNGET_SIGNER_DIR"
chmod 700 "$LNGET_SIGNER_DIR"

if [ "$NATIVE" = true ]; then
    mkdir -p "$LND_SIGNER_DIR"

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Store passphrase with restricted permissions on the host.
echo -n "$PASSWORD" > "$PASSWORD_FILE"
chmod 600 "$PASSWORD_FILE"
echo "Passphrase saved to $PASSWORD_FILE (mode 0600)"
echo ""

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# Store passphrase with restricted permissions on the host.
echo -n "$PASSWORD" > "$PASSWORD_FILE"
chmod 600 "$PASSWORD_FILE"
echo "Passphrase saved to $PASSWORD_FILE (mode 0600)"
echo ""

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "Signer lnd is already running."
    else
        echo "Starting signer lnd temporarily for wallet creation..."
        nohup lnd \
            --lnddir="$LND_SIGNER_DIR" \
            --configfile="$CONF_FILE" \
            > "$LNGET_SIGNER_DIR/signer-setup.log" 2>&1 &

• Confidence: 73% confidence
• Finding: Starting lnd with nohup in the background can leave a long-lived signer process running beyond the setup phase without explicit lifecycle control. In a security-sensitive remote signer context, unintended daemon persistence increases exposure by leaving RPC/REST services and key-handling software active longer than expected, especially if configuration or network binding changes later.

Static analysis

No suspicious patterns detected.