LYGO Champion: kairos herald of time

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:26 PM UTC
• Version: 1.0.1

Overview

This skill is a disclosed persona helper and legacy redirect with narrow local verification helpers, but users should be aware its suggested successor install command is unpinned.

Installers that use `@latest` can change over time, so review the successor skill and consider using a pinned ClawHub version or a sandboxed install if provenance matters. The current artifact itself is advisory and does not show hidden persistence or data access.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8

Finding

Unpinned Package Execution and Remote Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 8–9
Vulnerability Type: Unpinned third-party package execution and mutable remote Skill installation
Risk Level: Medium

Complete Code Snippet:

markdown

> **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only.
> `npx clawhub@latest install deepseekoracle/lygo-champion-council`

Technical Analysis

The documented command uses npx to resolve and execute the latest published version of the clawhub npm package. The package version is not pinned, and the remotely installed deepseekoracle/lygo-champion-council Skill is not constrained by an immutable version, cryptographic digest, or verified signature.

Therefore, the effective code and Skill instructions executed by a user can change after this repository has been audited. Compromise of the npm package, its publisher account, the package registry, or the remote Skill publisher could turn the recommended command into a supply-chain delivery mechanism. The audited repository does not itself contain a malicious payload; the risk arises when a user follows this mutable installation instruction.

Attack Path

1. An attacker compromises the clawhub npm package, its publisher account, or the remote successor Skill.
2. The attacker publishes a malicious release or replaces the remotely resolved Skill content.
3. A user or agent follows the command in SKILL.md.
4. npx downloads and executes the then-current clawhub@latest package.
5. The package installs the remotely resolved deepseekoracle/lygo-champion-council Skill.
6. Attacker-controlled package code may execute locally, or attacker-controlled Skill instructions may be loaded in subsequent agent activity.

Impact Assessment

Package code launched through npx runs with the privileges of the invoking user. Depending on the malicious upstream payload and loc ...[truncated 411 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed package version.
2. Pin the successor Skill to an immutable version or content digest.
3. Publish expected SHA-256 digests or signed provenance and verify them before installation.
4. Use lockfiles and integrity metadata where supported.
5. Prefer downloading the package and Skill into an isolated location for review before executing or activating them.
6. Run installation with least privilege in a sandbox or disposable environment.
7. Document the trusted publisher identity and a procedure for verifying signatures, hashes, and provenance.
8. Periodically review pinned versions before intentionally upgrading them.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description says this skill is only a deprecated slug redirect/legacy identifier for a champion, which implies little or no active behavior. The supplied code instead performs concrete validation logic over several local files: it checks required file existence, parses JSON from references/canon.json, validates the champion field, inspects verifier_usage.md for specific strings, and validates an optional SHA-256 value. That is a materially different primary purpose from a passive deprecated slug. While these are local reads only, the declared permissions list is empty and the behavior is operational self-auditing/verification, not just legacy aliasing. Therefore the description does not accurately represent the code.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The description says this skill is merely a deprecated legacy slug and implies alias/redirect behavior toward another skill, with no substantive function. The supplied code instead performs a concrete action: it accesses a local file, parses JSON, and prints a specific hash value. That is a materially different primary purpose and introduces undeclared file access/output behavior unrelated to a deprecation stub.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The skill instructs users to run 'npx clawhub@latest install ...', which pulls and executes the latest package version at install time. Using a floating latest tag creates a supply-chain risk: a compromised or malicious upstream release could execute unintended code in the user's environment.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.