LYGO Champion Council (Δ9 unified v2)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.1

Overview

This is a coherent advisory persona skill with simple local roster scripts; the main caveat is its unpinned npx-based install command.

Install only if you are comfortable running the ClawHub npm installer under your user account. For better assurance, pin the clawhub package version or use a controlled install process, and keep following the skill's own guidance not to provide secrets, .env contents, publishing access, or vault access unless you explicitly intend to.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:14

Finding

Unpinned npm Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 14
Vulnerability Type: Supply-chain risk from a mutable third-party dependency
Risk Level: Medium

Vulnerable Code Snippet:

bash

npx clawhub@latest install deepseekoracle/lygo-champion-council

Technical Analysis

The documented installation command instructs users to execute the mutable latest release of the third-party clawhub npm package. Because neither an exact package version nor an integrity digest is specified, the code executed by this command may differ from the version that was available when the Skill was audited.

npx may download the selected package and execute its CLI code locally. Consequently, compromise of the npm package, its publisher account, a future release, or a transitive dependency could introduce arbitrary executable behavior without requiring any change to this repository. The local project scripts themselves do not retrieve or execute remote code; the risk arises when a user follows the documented installation command.

Attack Path

1. An attacker compromises the clawhub npm publisher account, release process, package, or relevant dependency.
2. The attacker publishes a malicious version and causes it to resolve under the latest distribution tag.
3. A user follows the installation instructions and runs npx clawhub@latest install deepseekoracle/lygo-champion-council.
4. npx downloads and executes the attacker-controlled package version.
5. The malicious package runs with the permissions and environmental access of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the installing user's account. Depending on that user's privileges and execution environment, an attacker could read or modify accessible files, obtain environment variables or credentials available to the process, alter installed content, initiate network connections, or establi ...[truncated 350 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
• Where the package manager and deployment process support it, verify the package with a trusted integrity digest or registry signature before execution.
• Record the approved package version and checksum in the installation documentation.
• Review and pin transitive dependencies through an appropriate lockfile when maintaining a local installation wrapper.
• Avoid running the installer with administrative privileges.
• Execute installation in a restricted environment with minimal filesystem, credential, and network access where practical.
• Establish a controlled update process in which newer versions are reviewed before the documented pin is changed.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using 'npx clawhub@latest install ...' pulls and executes the latest published package version at install time, which makes the installation path dependent on mutable upstream state. If the package is compromised, typo-squatted, or a malicious version is later published, users could execute untrusted code during installation.

Content

No source excerpt is available for this finding.