ClawHub
Back to skill

Security audit

LNbits Wallet

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent LNbits wallet helper, but it handles full wallet credentials and can trigger real Lightning payments with safeguards that mostly depend on agent instructions rather than code-level controls.

Install only for a dedicated low-balance LNbits wallet. Set LNBITS_BASE_URL explicitly to a trusted HTTPS LNbits instance, avoid creating or sharing admin keys through chat, rotate any key that may have been exposed, and require a decoded invoice review plus an explicit yes/no confirmation before every payment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.getenv (line 63, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
req = urllib.request.Request(url, method=method, headers=headers, data=body)
    try:
        with urllib.request.urlopen(req, timeout=20) as resp:
            return json.loads(resp.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        error_body = e.read().decode("utf-8", errors="replace")
Confidence
93% confidence
Finding
with urllib.request.urlopen(req, timeout=20) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill uses environment variables and networked wallet operations but does not declare explicit permissions or scope boundaries. That omission can mislead operators about the skill's real capabilities, reducing informed consent and making accidental exposure of wallet credentials or unintended outbound actions more likely.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The declared description says the skill manages balance, payments, and invoices, but the instructions also enable wallet creation and invoice decoding. This mismatch hides materially sensitive behaviors, especially account creation and handling of payment artifacts, which can cause users or policy engines to authorize a broader capability set than intended.

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The advertised skill scope is balance, pay, and invoice management, but the code also supports creating new LNbits accounts/wallets. This capability expansion is dangerous because agents or users may invoke account creation without understanding the side effects, trust boundary changes, or provisioning of new wallet credentials on a remote service.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill instructs the agent to capture and then present a newly generated LNbits admin key to the user for storage, without strongly emphasizing that the admin key grants full spending control over the wallet. In an agent context, this increases the chance of secret exposure in chat logs, terminals, telemetry, or screenshots, leading directly to wallet takeover and fund theft.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
Paying a Bolt11 invoice is a value-transferring action, yet this handler executes it immediately with no confirmation, spend preview, or policy checks. In an agent context, that increases the risk of prompt-induced or accidental fund transfers because a single invocation can trigger irreversible payment.

Missing User Warnings

Medium
Confidence
89% confidence
Finding
The code performs authenticated network calls using an API key from the environment without any user-facing disclosure or consent step. In an agent-integrated skill, silent credential-backed external actions reduce transparency and make it easier for prompts or automation to trigger sensitive wallet operations unexpectedly.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.