ClawHub
Back to skill

Security audit

LYGO Champion: sraith shadow sentinel

Security checks for vulnerabilities and agentic risk

Overview

This is a small persona-helper skill with disclosed local reference files and no automatic high-risk behavior, though its migration and verifier guidance should be followed carefully.

Reasonable to install as a passive persona helper. Treat the migration command and external LYGO-MINT verifier as separate trust decisions: prefer pinned versions, inspect successor content, and avoid letting broad verifier prompts process file paths, URLs, or posting/backfill actions without explicit confirmation.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:8
Finding

Unpinned Remote Installation Through a Mutable npm Package

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:8-9
Vulnerability Type: Supply-chain risk from an unpinned remote installer
Risk Level: Medium

Vulnerable Code

markdown
> **Consolidated (Δ9 v2):** New installs → `lygo-champion-council`. This slug is legacy retention only.
> `npx clawhub@latest install deepseekoracle/lygo-champion-council`

Technical Analysis

The documented migration command executes the mutable latest release of the clawhub npm package and requests installation of successor content that is not included in the audited project. Neither the installer version nor the installed content is pinned to a reviewed version, commit, or cryptographic digest.

Consequently, the effective behavior can change after this audit. If the npm package, its dependency chain, the package publisher account, or the remote successor content is compromised, users following the documented command may execute or install content different from what was originally intended.

This is classified as insecure dependency usage rather than confirmed malicious remote execution because the project itself does not fetch or execute the payload automatically; a user must follow the documented command.

Attack Path

  1. An attacker compromises the npm package publisher, dependency chain, package registry entry, or remotely hosted successor content.
  2. The attacker publishes a modified release that becomes the package's latest version or modifies the content installed under deepseekoracle/lygo-champion-council.
  3. A user follows the migration command in SKILL.md.
  4. npx retrieves and executes the mutable installer release.
  5. The modified installer or unreviewed successor content runs with the permissions of the invoking user or is installed into the agent environment.
  6. The resulting impact depends on the invoking user's permissions and the behavior of the compromised installer.

Impact Assessment

...[truncated 496 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace clawhub@latest with an explicitly reviewed package version.
  • Pin the successor skill to an immutable release, commit identifier, or content digest.
  • Publish the expected SHA-256 digest and verify downloaded content before installation.
  • Review the installer and successor package whenever their pinned versions are updated.
  • Prefer installation mechanisms that separate retrieval from execution, allowing content to be inspected before it runs.
  • Document that installation should use an unprivileged account and an isolated environment.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/self_check.py:32
Finding

Integrity Check Does Not Validate Persona Pack Contents

Content
View full analysis

Vulnerability Details

File Location: scripts/self_check.py:32-35; related behavior in scripts/show_hash.py:4-6
Vulnerability Type: Ineffective cryptographic integrity validation
Risk Level: Medium

Vulnerable Code

scripts/self_check.py:32-35:

python
h = canon.get("lygo_mint_sha256")
if h is not None and (not isinstance(h, str) or len(h) != 64):
    print("BAD_CANON: lygo_mint_sha256 invalid")
    raise SystemExit(2)

scripts/show_hash.py:4-6:

python
canon_path = Path(__file__).resolve().parents[1] / "references" / "canon.json"
canon = json.loads(canon_path.read_text(encoding="utf-8"))
print(canon.get("lygo_mint_sha256") or "MISSING_HASH")

Technical Analysis

The self-check only confirms that the optional lygo_mint_sha256 value is a string containing 64 characters. It does not require the value to be valid hexadecimal, does not calculate a SHA-256 digest from references/persona_pack.md, and does not compare the calculated digest with the stored value.

The hash is also optional: if the field is absent, the check does not fail. Meanwhile, show_hash.py prints the value directly from the same locally editable canon.json file without validating the referenced persona pack.

Therefore, these scripts establish neither content authenticity nor content integrity. A modified persona pack can pass self_check.py as long as the stored metadata remains a 64-character string. If an attacker can edit both files, the attacker can also replace the stored value with another arbitrary 64-character string and have it displayed as though it were authoritative.

The canonical_snapshot value in references/canon.json points to a snapshot path that is not present in the audited directory structure, and neither script verifies that path.

Attack Path

  1. An attacker or compromised update process obtains write access to the installed skill files.
  2. The attacker modifies `re ...[truncated 1224 chars]
Remediation
View remediation

Remediation Suggestions

  • Require lygo_mint_sha256 to be present and match the regular expression ^[0-9a-f]{64}$.
  • Define the exact canonical byte representation that is hashed, including encoding and newline normalization.
  • Calculate SHA-256 directly from the canonicalized references/persona_pack.md contents.
  • Compare the calculated digest with the expected digest and terminate with a nonzero status on mismatch.
  • Make show_hash.py report both the expected and calculated digests and clearly indicate whether verification succeeded.
  • Use a constant-time comparison such as hmac.compare_digest for the final digest comparison.
  • Include and verify the referenced canonical snapshot, or remove the nonexistent canonical_snapshot field.
  • For authenticity against an attacker able to modify the entire package, store the trusted digest outside the mutable package or use a verified digital signature from a trusted publisher.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared purpose says this is a deprecated slug and points users to another skill, which suggests no substantive behavior beyond legacy identification or redirection. The supplied code instead actively inspects local files, parses JSON, validates required references, checks for specific text in documentation, and returns status codes. That is a materially different primary purpose and involves undeclared local file access. This is not just an implementation detail of a deprecated alias, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The declared description says this is merely a deprecated legacy slug to use another skill, implying aliasing or no-op metadata behavior. The actual code performs a concrete data access and output operation: it loads references/canon.json and prints the lygo_mint_sha256 value. That is a materially different primary purpose and accesses resources not suggested by the description. Therefore this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The skill recommends installing via 'npx clawhub@latest', which pulls the latest version at execution time rather than a pinned, reviewed version. If the upstream package is compromised or a breaking change is introduced, users could execute unexpected code during install, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The usage guidance relies on broad natural-language trigger phrases like “Mint this Champion pack,” “Show the hash + anchor snippet,” and “Backfill anchors,” which may be matched unintentionally by an agent framework and cause the verifier workflow to run on untrusted or unintended content. Because the skill also accepts pasted pack text, file paths, and posted URLs/IDs, accidental invocation could lead to processing attacker-controlled inputs or performing ledger/anchor actions without sufficiently explicit user confirmation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.