Lightningprox

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:06 PM UTC
• Version: 1.4.1

Overview

This skill is a straightforward guide for using a third-party AI gateway, with expected network and token use disclosed, though users should treat prompts and payment tokens carefully.

Install only if you are comfortable sending prompts, attachments, and payment credentials to lightningprox.com and potentially upstream model providers. Use a low-balance or limited spend token, keep it out of logs and shell history where possible, and pin or audit the optional npm SDK before using it in sensitive projects.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:79

Finding

Unpinned Third-Party npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 79–80
Vulnerability Type: Unpinned and unverifiable third-party dependency
Risk Level: Medium

The documentation instructs users to install an external npm package without specifying an exact version, integrity hash, lockfile, or source repository.

bash

npm install lightningprox-openai

Technical Analysis

Running npm install lightningprox-openai resolves the package version from the mutable npm registry state at installation time. The audited project does not include the dependency's source, a version constraint, a package-lock file, an integrity digest, or a verifiable source repository reference. Consequently, the code ultimately installed and executed is outside the reviewed artifact and may change after this audit.

npm packages can define lifecycle scripts that execute during installation. They also execute within the consuming application when imported. If the package, its publishing account, or one of its transitive dependencies is compromised, a malicious release could run with the privileges of the user performing the installation.

No evidence in the reviewed files establishes that lightningprox-openai is currently malicious. The vulnerability is the unsafe, unpinned supply-chain installation instruction.

Attack Path

1. An attacker compromises the npm publishing account, package, or a transitive dependency associated with lightningprox-openai.
2. The attacker publishes a malicious version or alters a dependency selected by the package.
3. A user follows the documented npm install lightningprox-openai instruction.
4. npm resolves and downloads the attacker-controlled version because no audited version or integrity value is pinned.
5. Malicious code executes through an npm lifecycle script or when the installed SDK is imported.
6. The code operates with the installing process's privileges and may access local data and envir ...[truncated 831 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact, reviewed version rather than resolving the latest release:

   bash

   npm install --save-exact lightningprox-openai@<audited-version>
   

2. Commit a generated package-lock.json and require deterministic installation with npm ci.
3. Verify and preserve the npm integrity digest for the reviewed package archive.
4. Link to a public, verifiable source repository and release tag corresponding exactly to the published package.
5. Audit the package's source, lifecycle scripts, and complete transitive dependency tree before recommending it.
6. Disable lifecycle scripts during installation where compatible:

   bash

   npm install --ignore-scripts --save-exact lightningprox-openai@<audited-version>
   

7. Run the SDK with least privilege and expose only the environment variables and filesystem paths it requires.
8. Add automated dependency scanning, lockfile review, provenance verification, and alerts for ownership or release changes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly instructs users to send prompts and authentication material to a third-party remote service, but it does not clearly warn that prompt contents, uploaded data, and token-bearing requests leave the local environment and become subject to the gateway's logging, retention, and handling practices. In a skill whose purpose is brokering inference to external providers, this omission creates a real privacy and data-handling risk, especially if users send sensitive prompts or secrets assuming local or first-party processing.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

This example performs an authenticated POST to an external endpoint and includes both user prompt content and a spend token in the request. The network transmission itself is expected for an AI gateway skill, but it is still security-relevant because it exposes prompt data to a third party and normalizes sending bearer-style credentials to that service without adjacent warnings about privacy, token handling, or provider relay.

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

bash

# 1. Top up at lightningprox.com/topup — pay Lightning invoice, get token
# 2. Use token directly
curl -X POST https://lightningprox.com/v1/messages \
  -H "Content-Type: application/json" \
  -H "X-Spend-Token: $LIGHTNINGPROX_SPEND_TOKEN" \
  -d '{

Static analysis

No suspicious patterns detected.