LYGO Branch: 401LYRAKIN — The Voice Between

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the user installs the linked verifier, they would be trusting a separate skill with its own behavior and file-writing workflow.

Why it was flagged

The skill points users to install a separate verifier skill that may write ledger artifacts. This is disclosed and aligned with the verification purpose, but it is outside the reviewed artifact set and should be evaluated separately before use.

Skill content

Install:
- https://clawhub.ai/DeepSeekOracle/lygo-mint-verifier

What it does:
- canonicalize a pack
- deterministic SHA-256 hash
- write append-only + canonical ledgers

Recommendation

Review the linked verifier skill's artifacts and permissions before installing it, and only use it when you intend to mint or update verification records.