LYGO API Token Saver

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:14 AM UTC
• Version: 1.0.0

Overview

The skill is mostly about reducing API token spend, but it asks users to run unaudited companion scripts and dependency installs that may access API keys.

Review this skill carefully before installing. Only use it in a controlled workspace, verify the companion repositories and dependencies yourself, avoid exposing both main and alternate API keys to the same process, and require explicit confirmation before running vault, proxy, cron, background, or metered model commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:12

Finding

Execution of Unverified External Components with Credential Access

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 12-23, 36-37, 53-56, and 76
Vulnerability Type: Unverified third-party scripts and dependencies
Risk Level: Medium

Vulnerable Instructions

text

2. Load vault: `python tools/load_biophase7_vault.py` → uses `XAI_API_KEY_ALT` before `XAI_API_KEY_MAIN`.

bash

cd lygo-protocol-stack
pip install -r requirements-pxpipe.txt
python tools/run_pxpipe_lygo_proxy.py

bash

cd "%LYGO_STACK_ROOT%\.grok\skills\lygo-ollama-army\ollama_command_center\scripts"
python army_cron_once.py

bash

python tools/run_falsifiable_vector_test.py --load-vault --models stack
# API spend only if asked:
python tools/run_falsifiable_vector_test.py --load-vault --models grok --limit 3

text

Install companion: `lygo-ollama-army`, `lygo-protocol-stack-operator`.

Technical Analysis

The skill directs users or agents to install dependencies and execute scripts from companion projects that are not included in the audited package. The package contains neither the referenced scripts nor requirements-pxpipe.txt, and it does not specify trusted source URLs, immutable revisions, package versions, or integrity hashes.

Consequently, the effective code executed by these instructions cannot be verified from the audited artifact. This is particularly sensitive for load_biophase7_vault.py and run_falsifiable_vector_test.py --load-vault, because those execution paths are expected to access xAI API credentials. Running an altered companion script or installing a compromised dependency could expose credentials or execute arbitrary code under the invoking user's account.

The audit does not establish that any referenced component is currently malicious. The risk arises from trusting external, unpinned, and unaudited components.

Attack Path

1. An attacker compromises, substitutes, or modifies a referenced companion repository, script, or package dependency.
2. A user installs the companion c ...[truncated 1157 chars]

Remediation

View remediation

Remediation Suggestions

1. Bundle all required scripts and dependency manifests in the skill package so they can be reviewed with the instructions.
2. Document canonical HTTPS source URLs and pin companion projects to immutable, reviewed commit hashes or signed releases.
3. Pin Python packages to exact versions and require cryptographic hashes, such as through a locked requirements file used with pip --require-hashes.
4. Verify release signatures or checksums before executing downloaded or separately installed components.
5. Run proxy, harness, and cron-related components in an isolated environment with minimal filesystem and network permissions.
6. Separate vault access from general-purpose scripts. Pass only the credential required for a specific operation and avoid exposing both alternate and main keys to the same process.
7. Require explicit confirmation before dependency installation, credential-enabled execution, or metered API calls.
8. Audit the companion projects and their transitive dependencies before treating the execution paths as trusted.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description defines broad activation cues such as 'token saver', 'save tokens', 'API budget', and 'before long Grok/Claude/GPT calls', which can cause the skill to activate in situations beyond the user's actual intent. Because the skill changes model/provider selection behavior and prefers alternate API-key paths and local processing, unintended activation could alter execution flow, cost controls, and data handling without sufficiently explicit user consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The invocation mapping includes ambiguous phrases like 'token saver', 'pay to go', and especially 'push all', which are not tightly scoped to cost-optimization behavior. In context, these phrases can trigger operational shortcuts such as using one subagent and avoiding rereads, increasing the risk of unexpected skill activation and unsafe automation behavior when a user uses similar wording in a different context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.