lnget: like wget but for L402 on the web

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:09 PM UTC
• Version: 1.0.0

Overview

The skill is coherent for using lnget, but it directs users toward real Lightning payments with overbroad node credentials and an unpinned remote install path.

Install only with a pinned, reviewed lnget version, avoid using an LND admin macaroon, prefer a least-privilege Lightning credential or limited wallet with low balance, use --no-pay and conservative --max-cost/--max-fee limits first, and periodically clear cached tokens and revoke unused LNC sessions.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: scripts/install.sh:48
• Finding: Mutable Remote Code Installation Through Unpinned Latest Release<![CDATA[ ## Vulnerability Details **File Location**: `scripts/install.sh:48-50` **Vulnerability Type**: Mutable remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Default to @latest when no version specified. VERSION="${VERSION:-@latest}" echo "=== Installing lnget ===" ``` The value is subsequently used at `scripts/install.sh:61`: ```bash go install "github.com/lightninglabs/lnget/cmd/lnget${VERSION}" ``` ### Technical Analysis When no version is specified, the installer resolves `github.com/lightninglabs/lnget/cmd/lnget@latest` at installation time. This downloads source code and dependencies from external infrastructure, compiles them, and installs the resulting executable under the invoking user's account. Because `@latest` is mutable, the installed code can differ from the code that existed when this Skill was audited. The installation documentation also recommends an unpinned `git clone` as an alternative. The referenced repository is consistent with the Skill's declared functionality, and there is no evidence in the audited files that it is currently malicious. Nevertheless, the installation mechanism creates a remote code execution channel whose effective payload can change after review. The optional `--version` argument allows callers to select a version, but secure pinning is not the default, and the script performs no checksum or signature verification. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, release process, Go module distribution path, or a transitive dependency. 2. The attacker publishes a malicious version that is selected by the `@latest` query. 3. A user invokes `scripts/install.sh` without an explicit reviewed version. 4. `go install` downloads and compiles the changed remote source and its dependency graph. 5. The malicious binary is installed with the user's permissions. 6. When the user or agent runs `lnget`, the payload can access files and ...[truncated 720 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `@latest` with a specific, reviewed, immutable release version. 2. Require an explicit version rather than silently defaulting to the latest release. 3. Verify the selected release using a trusted checksum, signed tag, or provenance record before installation. 4. Pin and review the relevant Go dependency graph, and use automated dependency monitoring for controlled upgrades. 5. Document an explicit update procedure so version changes receive security review before deployment. 6. Avoid recommending an unpinned `git clone`; check out a verified release tag or commit hash when building from source. 7. Run installation and the resulting binary as a non-privileged user with access only to the files required for its operation. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:157
• Finding: Use of LND Administrator Macaroon Violates Least Privilege<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:157-167` **Vulnerability Type**: Excessively privileged Lightning node credential **Risk Level**: High ### Vulnerable Code ```yaml ln: mode: lnd # Options: lnd, lnc, neutrino lnd: host: localhost:10009 tls_cert: ~/.lnd/tls.cert macaroon: ~/.lnd/data/chain/bitcoin/mainnet/admin.macaroon network: mainnet ``` ### Technical Analysis The reference configuration directs users to grant `lnget` access to LND's `admin.macaroon`. An administrator macaroon generally authorizes substantially broader node operations than the limited payment-related RPC permissions required to satisfy L402 invoices. This violates least-privilege principles. `lnget` is a network-facing HTTP client that processes responses from external servers and is installed from remote source code. Providing it with an administrator credential unnecessarily increases the consequences of a vulnerability in the client, its dependencies, or its local execution environment. The audited Skill does not explicitly transmit the LND macaroon to external HTTP servers. Its documented transmission of an L402 macaroon and payment preimage in an `Authorization` header is part of the declared L402 protocol. The issue is that the client is instructed to possess a much more powerful local node credential than its declared operation appears to require. ### Attack Path 1. A user follows the documented reference configuration and grants `lnget` read access to `~/.lnd/data/chain/bitcoin/mainnet/admin.macaroon`. 2. The installed client, one of its dependencies, or the user's account is compromised. 3. The attacker reads or uses the administrator macaroon through the local LND interface. 4. The attacker invokes any node operations permitted by that macaroon, including capabilities unrelated to fetching an L402-protected resource. 5. The attacker retains those capabilities until the compromised macaroon is revoked, replaced ...[truncated 791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the administrator macaroon example with a dedicated least-privilege baked macaroon containing only the LND RPC permissions required by `lnget`. 2. Determine and document the exact RPC calls made for status checks, invoice payment, and payment tracking; grant only those permissions. 3. Explicitly warn users not to configure `admin.macaroon`. 4. Use a dedicated Lightning account, node, or wallet with a limited balance where practical. 5. Enforce restrictive filesystem permissions on the macaroon, configuration, LNC sessions, and cached L402 tokens. 6. Add spending controls independent of the client, because client-side `max_cost_sats` limits should not be the sole protection against a compromised process. 7. Provide credential rotation and revocation instructions and recommend periodic auditing of Lightning payments. 8. Keep the LND RPC endpoint restricted to trusted local or authenticated interfaces. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly describes automatic Lightning invoice payment and token reuse, but the introductory text does not prominently warn that using the tool can spend real funds and cache paid authorization tokens for future requests. In an agent context, that omission increases the risk of unintended micropayments and silent re-use of previously purchased access against remote services.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The Quick Start demonstrates fetching an L402-protected resource immediately after setup, which may cause automatic payment, but it provides no warning before the example. Because Quick Start snippets are the most likely to be copied verbatim, this materially increases the chance of accidental spending by users or autonomous agents.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

lnget config init

# 3. Fetch an L402-protected resource
lnget --max-cost 1000 https://api.example.com/paid-data
```

## Installation

• Confidence: 50% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Session Persistence

Medium

• Category: Rogue Agent

Content

## Configuration File

Config lives at `~/.lnget/config.yaml`. Run `lnget config init` to create it.

**Note:** `lnget config init` may generate incorrect YAML key names (e.g.,
`tlscertpath` and `macaroonpath` instead of `tls_cert` and `macaroon`) due to

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.