LYGO Alignment Badge

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:45 AM UTC
• Version: 1.0.1

Overview

This skill is a small verification guide for LYGO alignment badges, with no bundled executable code, but users should be aware that its install command uses an unpinned npx package.

Install only if you are comfortable with the LYGO project and the ClawHub installer source. For tighter supply-chain control, use a pinned or otherwise verified installer version and run the LYGO verification commands in a quarantined copy of any third-party repository.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Unpinned Third-Party Installer Execution via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 44
Vulnerability Type: Supply-chain risk caused by a mutable dependency reference
Risk Level: Medium

Vulnerable Code

markdown

**Install:** `npx clawhub@latest install deepseekoracle/lygo-alignment-badge`

Technical Analysis

The installation command invokes npx with the mutable latest tag. If the requested package is not already available locally, npx can retrieve and execute it from the configured npm registry. Because neither an exact version nor an integrity digest is specified, the code executed by future users may differ from the version that was originally reviewed.

This creates a supply-chain trust boundary outside the audited project. Compromise of the package publisher, registry account, release pipeline, package dependencies, or configured registry could cause the command to execute attacker-controlled code. The referenced installer and LYGO repository scripts were not included in this artifact, so their behavior could not be verified during this audit.

Attack Path

1. An attacker compromises the clawhub package publisher, its release pipeline, or an npm registry used by the victim.
2. The attacker publishes a malicious release that becomes the package's latest version.
3. A user follows the installation instruction in SKILL.md.
4. npx downloads and executes the mutable package release.
5. The malicious package runs with the permissions and environment of the invoking user.

Impact Assessment

Successful exploitation could allow arbitrary code execution under the invoking user's account. Depending on that user's privileges and environment, the payload could access readable files, environment variables, source repositories, credentials, and network resources, or modify user-writable files. This finding does not establish that the current package is malicious; it identifies the risk created by executing an externally controlled, unpinned release ...[truncated 1 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify the package's provenance, publisher identity, release signatures, and registry integrity before execution.
• Where supported, validate the downloaded artifact against a trusted cryptographic digest.
• Use a lockfile or an equivalent reproducible dependency mechanism for transitive dependencies.
• Test installation in a sandboxed, least-privileged environment without unnecessary secrets or host access.
• Establish a controlled update process in which new versions are reviewed and approved before changing the pinned version.
• Consider installing the verified package separately and invoking the known local binary rather than allowing npx to resolve a mutable version at execution time.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The install instruction uses npx clawhub@latest, which fetches and executes the latest published package version at runtime without pinning. This creates a supply-chain risk: if the package is compromised, typosquatted, or updated maliciously, users running the documented command could execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.