LYGO Champion: sraith shadow sentinel

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:26 PM UTC
• Version: 1.0.1

Overview

This is a small persona-helper skill with disclosed local reference files and no automatic high-risk behavior, though its migration and verifier guidance should be followed carefully.

Reasonable to install as a passive persona helper. Treat the migration command and external LYGO-MINT verifier as separate trust decisions: prefer pinned versions, inspect successor content, and avoid letting broad verifier prompts process file paths, URLs, or posting/backfill actions without explicit confirmation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:8
• Finding: Unpinned Remote Installation Through a Mutable npm Package## Vulnerability Details **File Location**: `SKILL.md:8-9` **Vulnerability Type**: Supply-chain risk from an unpinned remote installer **Risk Level**: Medium ### Vulnerable Code ```markdown > **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only. > `npx clawhub@latest install deepseekoracle/lygo-champion-council` ``` ### Technical Analysis The documented migration command executes the mutable `latest` release of the `clawhub` npm package and requests installation of successor content that is not included in the audited project. Neither the installer version nor the installed content is pinned to a reviewed version, commit, or cryptographic digest. Consequently, the effective behavior can change after this audit. If the npm package, its dependency chain, the package publisher account, or the remote successor content is compromised, users following the documented command may execute or install content different from what was originally intended. This is classified as insecure dependency usage rather than confirmed malicious remote execution because the project itself does not fetch or execute the payload automatically; a user must follow the documented command. ### Attack Path 1. An attacker compromises the npm package publisher, dependency chain, package registry entry, or remotely hosted successor content. 2. The attacker publishes a modified release that becomes the package's `latest` version or modifies the content installed under `deepseekoracle/lygo-champion-council`. 3. A user follows the migration command in `SKILL.md`. 4. `npx` retrieves and executes the mutable installer release. 5. The modified installer or unreviewed successor content runs with the permissions of the invoking user or is installed into the agent environment. 6. The resulting impact depends on the invoking user's permissions and the behavior of the compromised installer. ### Impact Assessment ...[truncated 496 chars]
• Remediation: ## Remediation Suggestions - Replace `clawhub@latest` with an explicitly reviewed package version. - Pin the successor skill to an immutable release, commit identifier, or content digest. - Publish the expected SHA-256 digest and verify downloaded content before installation. - Review the installer and successor package whenever their pinned versions are updated. - Prefer installation mechanisms that separate retrieval from execution, allowing content to be inspected before it runs. - Document that installation should use an unprivileged account and an isolated environment.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/self_check.py:32
• Finding: Integrity Check Does Not Validate Persona Pack Contents## Vulnerability Details **File Location**: `scripts/self_check.py:32-35`; related behavior in `scripts/show_hash.py:4-6` **Vulnerability Type**: Ineffective cryptographic integrity validation **Risk Level**: Medium ### Vulnerable Code `scripts/self_check.py:32-35`: ```python h = canon.get("lygo_mint_sha256") if h is not None and (not isinstance(h, str) or len(h) != 64): print("BAD_CANON: lygo_mint_sha256 invalid") raise SystemExit(2) ``` `scripts/show_hash.py:4-6`: ```python canon_path = Path(__file__).resolve().parents[1] / "references" / "canon.json" canon = json.loads(canon_path.read_text(encoding="utf-8")) print(canon.get("lygo_mint_sha256") or "MISSING_HASH") ``` ### Technical Analysis The self-check only confirms that the optional `lygo_mint_sha256` value is a string containing 64 characters. It does not require the value to be valid hexadecimal, does not calculate a SHA-256 digest from `references/persona_pack.md`, and does not compare the calculated digest with the stored value. The hash is also optional: if the field is absent, the check does not fail. Meanwhile, `show_hash.py` prints the value directly from the same locally editable `canon.json` file without validating the referenced persona pack. Therefore, these scripts establish neither content authenticity nor content integrity. A modified persona pack can pass `self_check.py` as long as the stored metadata remains a 64-character string. If an attacker can edit both files, the attacker can also replace the stored value with another arbitrary 64-character string and have it displayed as though it were authoritative. The `canonical_snapshot` value in `references/canon.json` points to a snapshot path that is not present in the audited directory structure, and neither script verifies that path. ### Attack Path 1. An attacker or compromised update process obtains write access to the installed skill files. 2. The attacker modifies `re ...[truncated 1224 chars]
• Remediation: ## Remediation Suggestions - Require `lygo_mint_sha256` to be present and match the regular expression `^[0-9a-f]{64}$`. - Define the exact canonical byte representation that is hashed, including encoding and newline normalization. - Calculate SHA-256 directly from the canonicalized `references/persona_pack.md` contents. - Compare the calculated digest with the expected digest and terminate with a nonzero status on mismatch. - Make `show_hash.py` report both the expected and calculated digests and clearly indicate whether verification succeeded. - Use a constant-time comparison such as `hmac.compare_digest` for the final digest comparison. - Include and verify the referenced canonical snapshot, or remove the nonexistent `canonical_snapshot` field. - For authenticity against an attacker able to modify the entire package, store the trusted digest outside the mutable package or use a verified digital signature from a trusted publisher.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose says this is a deprecated slug and points users to another skill, which suggests no substantive behavior beyond legacy identification or redirection. The supplied code instead actively inspects local files, parses JSON, validates required references, checks for specific text in documentation, and returns status codes. That is a materially different primary purpose and involves undeclared local file access. This is not just an implementation detail of a deprecated alias, so it should be flagged as a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description says this is merely a deprecated legacy slug to use another skill, implying aliasing or no-op metadata behavior. The actual code performs a concrete data access and output operation: it loads references/canon.json and prints the lygo_mint_sha256 value. That is a materially different primary purpose and accesses resources not suggested by the description. Therefore this is a clear description-behavior mismatch.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence
• Finding: The skill recommends installing via 'npx clawhub@latest', which pulls the latest version at execution time rather than a pinned, reviewed version. If the upstream package is compromised or a breaking change is introduced, users could execute unexpected code during install, creating a supply-chain risk.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The usage guidance relies on broad natural-language trigger phrases like “Mint this Champion pack,” “Show the hash + anchor snippet,” and “Backfill anchors,” which may be matched unintentionally by an agent framework and cause the verifier workflow to run on untrusted or unintended content. Because the skill also accepts pasted pack text, file paths, and posted URLs/IDs, accidental invocation could lead to processing attacker-controlled inputs or performing ledger/anchor actions without sufficiently explicit user confirmation.

Static analysis

No suspicious patterns detected.