ClawHub
Back to skill

Security audit

lnd macaroon bakery

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate least-privilege Lightning credential purpose, but its rotation guidance and container credential handling could leave sensitive node access credentials exposed or unrevoked.

Review this skill carefully before installing on a production lnd node. Use it only with credentials and containers you control, avoid inspecting or baking admin macaroons in shared containers, and do not rely on the documented rotation command until the revocation steps are corrected and verified with listmacaroonids/deletemacaroonid for your lnd version.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bake.sh:161
Finding

Predictable Container Temporary Files Can Expose Privileged Macaroons

Content
View full analysis

Vulnerability Details

File Location: scripts/bake.sh, lines 161-187 and 324-327
Vulnerability Type: Predictable temporary credential files and incomplete cleanup
Risk Level: Medium

Vulnerable code (inspection path, lines 161-187):

bash
if [ -n "$CONTAINER" ]; then
    # The macaroon may be on the host or inside the container. If it
    # exists on the host, copy it into the container for inspection.
    if [ -f "$INSPECT" ]; then
        CONTAINER_TMP="/tmp/inspect-$(date +%s).macaroon"
        docker cp "$INSPECT" "$CONTAINER:$CONTAINER_TMP"
        INSPECT_PATH="$CONTAINER_TMP"
    elif docker exec "$CONTAINER" test -f "$INSPECT" 2>/dev/null; then
        INSPECT_PATH="$INSPECT"
    else
        echo "Error: Macaroon file not found: $INSPECT" >&2
        exit 1
    fi
elif [ ! -f "$INSPECT" ]; then
    echo "Error: Macaroon file not found: $INSPECT" >&2
    exit 1
else
    INSPECT_PATH="$INSPECT"
fi
echo "=== Macaroon: $(basename "$INSPECT") ==="
echo "Path: $INSPECT"
if [ -n "$CONTAINER" ]; then
    echo "Container: $CONTAINER"
fi
echo ""
"${LNCLI_CMD[@]}" printmacaroon --macaroon_file "$INSPECT_PATH"
# Clean up temporary copy if we created one.
if [ -n "$CONTAINER" ] && [ -f "$INSPECT" ]; then
    docker exec "$CONTAINER" rm -f "$INSPECT_PATH" 2>/dev/null || true
fi

Vulnerable code (baking path, lines 324-327):

bash
CONTAINER_TMP="/tmp/baked-$(date +%s).macaroon"
"${LNCLI_CMD[@]}" bakemacaroon "${PERMS[@]}" --save_to="$CONTAINER_TMP"
docker cp "$CONTAINER:$CONTAINER_TMP" "$SAVE_TO"
docker exec "$CONTAINER" rm -f "$CONTAINER_TMP"

Technical Analysis

Macaroons are bearer credentials that may authorize payments, invoice management, channel administration, signing, or custom operations. The script stores these credentials under the container's shared /tmp directory using filenames based only on `d ...[truncated 2261 chars]

Remediation
View remediation

Remediation Suggestions

  • Create a private temporary directory inside the container using a cryptographically unpredictable mechanism such as mktemp -d.
  • Set the temporary directory to mode 0700 and generated credential files to mode 0600 before use.
  • Reject pre-existing files, symbolic links, and non-regular files. Ensure credential creation uses exclusive semantics where supported.
  • Register cleanup immediately with an EXIT, INT, and TERM trap so temporary credentials are removed on success, command failure, interruption, or early exit.
  • Avoid a shared temporary directory where possible. Stream data securely or use a dedicated bind-mounted directory accessible only to the intended container user.
  • Verify the ownership and permissions of the container-side credential before copying or inspecting it.
  • Use distinct randomized temporary paths for concurrent executions to prevent collisions.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:132
Finding

Documented Macaroon Rotation Command Does Not Revoke the Old Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 132-135
Vulnerability Type: Incorrect credential-revocation procedure
Risk Level: Medium

Vulnerable documentation:

bash
# 3. Delete the old macaroon's root key (invalidates it)
skills/lnd/scripts/lncli.sh bakemacaroon --root_key_id 0
# Note: use lncli listmacaroonids and deletemacaroonid for fine-grained control

Technical Analysis

The documentation states that the displayed command deletes the old macaroon's root key. However, bakemacaroon creates a macaroon; it is not a root-key deletion operation. Running the documented command therefore does not perform the revocation claimed by the preceding comment.

Credential rotation only limits exposure when the prior credential is actually invalidated or otherwise rejected. Baking another macaroon does not inherently revoke previously issued macaroons. The documentation mentions listmacaroonids and deletemacaroonid, but presents them only as an optional note rather than making the actual revocation operation part of the required procedure.

Attack Path

  1. An attacker obtains an existing macaroon through host compromise, accidental disclosure, insecure backup, or another credential leak.
  2. The operator creates a replacement macaroon and updates the agent configuration.
  3. The operator follows the documented third step, expecting bakemacaroon --root_key_id 0 to invalidate the former credential.
  4. The command creates or bakes a credential rather than deleting the relevant root key.
  5. The attacker continues authenticating with the previously stolen macaroon because its root key remains active.
  6. Unauthorized operations remain possible until the correct root key is revoked or another control rejects the old credential.

Impact Assessment

An attacker retains every privilege granted by the compromised macaroon. Depending on its scope, this may include reading node information ...[truncated 468 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace the incorrect bakemacaroon command with a tested revocation procedure using the supported listmacaroonids and deletemacaroonid commands for the deployed lnd version.
  • Require the operator to enumerate root-key IDs and identify the exact key associated with the old macaroon before deletion.
  • Clearly warn that deleting a root key revokes all macaroons derived from that key, not merely one credential file.
  • Generate different agent or rotation generations from intentionally selected root keys where fine-grained revocation is required.
  • Add a post-rotation verification step that attempts authentication with the old macaroon and confirms that it is rejected.
  • Preserve a recovery plan for dependent services that may use other macaroons derived from the deleted root key.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill clearly instructs the user to execute shell scripts and remote/containerized commands, but the metadata declares no explicit tool scope or allowed-tools boundary. In an agent setting, that omission can cause overbroad execution authority or make it unclear what shell access is expected, increasing the chance of unintended command execution against local files, containers, or remote LND environments.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The rotation section includes a destructive invalidation step but does not prominently warn that deleting or rotating macaroon root keys can immediately break active agents and services using existing credentials. In this skill's context, macaroons are production auth tokens for Lightning infrastructure, so unclear guidance can cause outages or accidental revocation of critical access.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
80% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/bake.sh (reported line 325)May include surrounding context.

sh
fi

# Set restrictive permissions.
chmod 600 "$SAVE_TO"

echo ""
echo "=== Macaroon Baked ==="

Static analysis

No suspicious patterns detected.