LYGO Champion: aetheris viral truth

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:27 PM UTC
• Version: 1.0.1

Overview

This is a disclosed persona helper with read-only local verification scripts, though its optional migration command should be reviewed before use.

Install this only if you want the AETHERIS persona helper or its successor. Treat the npx clawhub@latest migration command as a separate trust decision: prefer reviewing the successor skill and using a pinned, verified installer version before running it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Third-Party Package Execution and Successor Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 8
Vulnerability Type: T08: Insecure Dependencies
Risk Level: Medium

Vulnerable Code Snippet:

text

> `npx clawhub@latest install deepseekoracle/lygo-champion-council`

Technical Analysis

The documented migration command instructs users to execute the mutable latest release of the third-party clawhub npm package. It then installs a successor Skill whose contents are not included in this repository and were therefore outside the audited codebase.

The latest tag is not immutable. Its resolved package contents can change after this Skill has been reviewed. The command does not pin a package version, enforce a package integrity digest, identify an expected successor artifact hash, or require review before activation. Consequently, the effective code and Skill instructions executed by users may differ from those covered by this audit.

This constitutes an unsafe supply-chain boundary. It is not evidence that the current external packages are malicious, but the installation method creates exposure if the npm package, publishing account, registry resolution, or successor Skill is compromised or unexpectedly changed.

Attack Path

1. An attacker compromises the clawhub package, its publisher account, its dependency chain, or another relevant distribution component.
2. The attacker publishes a modified release and causes the mutable latest tag to resolve to it.
3. A user follows the migration command in SKILL.md.
4. npx downloads and executes the package resolved by clawhub@latest.
5. The downloaded package can run with the invoking user's privileges and install an unaudited successor Skill.
6. Malicious executable behavior or instructions may then affect the local environment or Agent.

Impact Assessment

Successful exploitation could permit code supplied through the package distribution chain to execute with the privileges of the user running npx. The resu ...[truncated 533 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with a specific, reviewed package version.
2. Pin and verify the npm package integrity value through a lockfile or equivalent immutable integrity control.
3. Publish and validate the expected cryptographic digest or signed provenance of the successor Skill before installation.
4. Review the complete successor Skill, including its scripts, dependencies, hooks, and instructions, before activation.
5. Avoid automatically trusting or enabling the installed Skill merely because installation completed successfully.
6. Run installation with the minimum required privileges in an isolated environment where practical.
7. Document a controlled upgrade process that requires explicit review whenever the package version or successor artifact digest changes.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this is a deprecated slug to use another skill, which implies little or no operational behavior beyond legacy redirection. The actual code is an active self-check utility that accesses several local files, parses canon.json, validates fields and references, and returns status codes. That is a materially different primary purpose from a deprecated alias, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description says this skill is merely a deprecated legacy slug that should redirect users to another skill and declares no permissions or triggers. The supplied code instead performs a concrete utility action: it accesses a local JSON file under references/canon.json, retrieves the lygo_mint_sha256 value, and prints it. That is a materially different primary purpose from being a deprecated alias/slug, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub@latest pulls the latest published package at install time, which is a classic supply-chain risk because behavior can change without review. An attacker who compromises the package, publisher account, or dependency chain could cause users following the instruction to run untrusted code.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The operation formula and surrounding persona framing describe broad propagation behavior without any explicit trigger boundaries, target restrictions, or safe-use constraints. In an agent skill context, ambiguous activation semantics can cause the persona to be invoked in unintended contexts and encourage expansive behavior around 'truth propagation' and identifying sources of lies, which can lead to overreach, misclassification, or manipulative outputs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The initiation whisper is a direct, reusable invocation phrase that lacks any boundaries on who can activate it, in what context, or what the persona is allowed to do once activated. Because it combines contagion/outbreak language with an imperative to find the 'root' and 'origin,' it can prime agents toward uncontrolled role activation, conspiracy-seeking, or adversarial truth-hunting beyond the user's legitimate task.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.