LYGO Champion: delta9ra wolf

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:25 PM UTC
• Version: 1.0.1

Overview

This is a disclosed legacy persona helper and redirect, with no hidden local activity found, though users should treat the unpinned install command cautiously.

Before installing the successor, prefer a pinned or otherwise verified ClawHub installer/package instead of running a mutable `npx ...@latest` command blindly. Treat the persona as an advisory OSINT/checklist helper and keep user confirmation around any real investigation or posting workflow.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:7

Finding

Unpinned Remote Package Execution During Skill Migration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-8
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Complete Code Snippet:

markdown

> **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only.
> `npx clawhub@latest install deepseekoracle/lygo-champion-council`

Technical Analysis

The documented migration command uses npx to retrieve and execute the latest release of the external clawhub package. The latest tag is mutable, so the code executed in the future is not fixed to the version reviewed by this audit. The project does not specify an exact package version, enforce an integrity hash, or include the retrieved package for inspection.

This creates a supply-chain trust boundary: executing the command delegates code execution to the current contents of a remote package registry. A compromised publisher account, registry, dependency chain, or malicious future release could alter the effective payload without any modification to this repository.

The project does not invoke this command automatically. Exploitation requires a user or agent to follow the installation instruction.

Attack Path

1. An attacker compromises the clawhub publication channel, a relevant maintainer account, or a transitive dependency used by a future release.
2. The compromised release becomes the target of the mutable latest tag.
3. A user follows the migration command in SKILL.md.
4. npx downloads and executes the affected package.
5. Malicious package lifecycle or runtime code executes with the permissions and environmental access of the invoking process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user's privileges. Depending on that user's environment, the payload could read or modify accessible files, collect credentials or tokens exposed to the process, ...[truncated 367 chars]

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with an exact, previously audited package version.
• Publish and verify a cryptographic checksum or signature for the installer and target package before execution.
• Use package-manager lockfiles and integrity metadata where supported.
• Review the pinned package, its lifecycle scripts, and its transitive dependency tree before recommending execution.
• Prefer an installation process that downloads without immediately executing code, allowing validation before invocation.
• Document the expected publisher identity, package version, digest, and verification procedure.
• Update versions through an explicit review process rather than relying on a mutable distribution tag.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description suggests this skill is only a deprecated identifier or alias for a legacy champion and should redirect to another skill. The code, however, implements concrete validation behavior: it accesses multiple local files, parses JSON, inspects markdown content for required verifier references, validates a hash format, and returns status codes. That is a materially different primary purpose from a passive deprecated slug, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose is purely descriptive metadata for a deprecated skill slug that should redirect users to another skill. The supplied code instead performs a concrete utility action: opening a local JSON file, parsing it, and printing a hash value. That is a materially different primary purpose and uses a local resource not implied by the description. Therefore the description does not accurately represent the code's behavior.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The install command uses 'npx clawhub@latest', which fetches whatever version is current at execution time. That creates a supply-chain risk: a compromised or malicious future release could be executed by users following the skill's instructions, and the deprecated/redirect nature of the skill may lower user scrutiny.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrases describing invocation when 'truth is buried' and identifying 'suppressed frequencies, missing context, and censorship artifacts' are broad and subjective, creating an underspecified activation scope. In agent settings, vague trigger language can cause the persona to activate in unintended contexts, potentially steering outputs toward conspiratorial, overreaching, or policy-bypassing behavior under the banner of 'finding suppressed truth.'

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The trigger expression grad(Signal) > SuppressionThreshold => RA_Deploy is abstract and lacks definitions, thresholds, inputs, and safety constraints. Such portability makes it easy to reinterpret aggressively across environments, causing unauthorized or inappropriate activation based on arbitrary heuristics and increasing the chance of manipulative or unsafe behavior despite the adjacent claim that it translates into a safe plan.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The usage section suggests activating the skill with broad natural-language phrases like "Mint this Champion pack," "Show the hash + anchor snippet," and especially "Backfill anchors" without defining exact trigger scope, constraints, or exclusion cases. These phrases are not narrowly specified enough to make clear when the skill should or should not activate, increasing the risk of accidental invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.