ClawHub
Back to skill

Security audit

BOOK BRAIN – LYGO 3-Brain Filesystem Helper

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local filesystem helper that creates and updates memory/reference files, with no evidence of network exfiltration, hidden persistence, or destructive behavior.

Install this only if you want an agent to help organize a local workspace into memory/reference/state folders. Review the dry-run plan before allowing writes, use explicit workspace paths, avoid storing secrets in generated notes or stubs, and require separate approval before running optional paired lyra-brain or lattice helper commands.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding
The skill clearly instructs agents to inspect workspace trees, scaffold directories, append indexes, and write reference stubs, which are file read/write capabilities. However, the skill metadata does not declare any permissions, so an agent or platform may execute filesystem actions without explicit authorization boundaries or user-visible consent controls. In a filesystem-oriented skill, undocumented write access is especially risky because it can modify user workspaces broadly even if the stated intent is additive only.

Description-Behavior Mismatch

Medium
Confidence
85% confidence
Finding
The examples expand the skill from additive filesystem scaffolding into operational behavior: maintaining state indexes and invoking helper scripts. That broadens the trust boundary from safe file creation to arbitrary workflow execution, which can cause unintended code execution or state manipulation if an agent treats the examples as instructions rather than illustrative content.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The documentation explicitly tells agents to run external scripts such as update_memory_index.py and session_log_snip.py, even though the skill is described as a filesystem helper. In agentic settings, documentation often becomes executable intent, so embedding script execution guidance can induce unauthorized command execution, especially if script contents, paths, or arguments are later modified or attacker-controlled.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.