LYGO CLI Bridge

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:43 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent, but it can load unverified companion Python code from mutable or environment-directed locations.

Review this skill before installing in sensitive environments. Its core behavior is not destructive, but avoid copy-pasting @latest install commands for trusted workflows, verify companion package provenance, and do not set LYGO_STACK_ROOT to directories that other users or automation can modify.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Skill Installation Creates a Mutable Supply-Chain Boundary

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scripts/lygo_cli.py:97

Finding

Environment-Directed Companion Discovery Enables Unverified Python Module Execution

Content

View full analysis

list[Path]: stack = os.environ.get("LYGO_STACK_ROOT", "").strip() out = [ SKILLS_ROOT / slug / rel, Path(r"I:\E Drive\.grok\skills") / slug / rel, Path.home() / ".grok" / "skills" / slug / rel, ] if stack: out.append(Path(stack) / "clawhub" / "mirrors" / slug / rel) out.append(Path(stack) / "docs" / "skills" / slug / rel) return out def find_skill_file(slug: str, rel: str) -> Path | None: for p in _skill_candidates(slug, rel): if p.is_file(): return p return None def import_from(path: Path, module_name: str) -> Any: scripts = str(path.parent) if scripts not in sys.path: sys.path.insert(0, scripts) # Avoid stale module if switching skills if module_name in sys.modules: del sys.modules[module_name] return __import__(module_name) ``` Examples of the resulting execution paths include: ```python det_path = find_skill_file("lygo-ops-detector", "scripts/lygo_ops_detector.py") ... det = import_from(det_path, "lygo_ops_detector") report = det.analyze(text=body, notes="cli-bridge") ``` ```python mw = find_skill_file("lygo-mint-walkthrough", "scripts/mint_walkthrough.py") if mw and pack: m = import_from(mw, "mint_walkthrough") out = m.step_mint(pack, version, "", i_consent) ``` ```python radar = find_skill_file("lygo-deception-radar", "scripts/build_radar_feed.py") ... b = import_from(radar, "build_radar_feed") ``` ### Technical Analysis The CLI accepts `LYGO_STACK_ROOT` from the process environment and derives executable companion locations from it. A candidate is ...[truncated 2745 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clawhub@latest fetches and executes whatever version is current at install time, which creates a supply-chain risk and undermines reproducibility. If the upstream package is compromised or a breaking release is published, users could install or run unexpected code when following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This installation command also uses npx clawhub@latest, exposing users to execution of an unpinned remote package version. Because this is a companion dependency path, compromise of the installer or unexpected updates could affect a broader set of related skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The command relies on an unpinned npx package, which means users execute mutable remote code during installation. In the context of a skill ecosystem, this increases supply-chain exposure even if the skill itself claims local-first and no subprocess behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This documented install path repeats the same unpinned npx clawhub@latest pattern, creating a consistent supply-chain weakness across setup instructions. An attacker controlling or compromising the package distribution path could cause users to run malicious code before they ever use the skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The quickstart instructs users to run npx clawhub@latest install ..., which pulls and executes the latest published package version rather than a pinned, reviewed release. If the upstream package or its distribution path is compromised, users could install unexpected or malicious code, and documentation examples increase the likelihood of copy-paste execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This line also uses npx clawhub@latest install ..., creating a supply-chain risk because users are directed to execute whatever version is current at runtime. In security-sensitive tooling, unpinned install commands in docs are dangerous because they normalize unaudited remote code execution during setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The command references an unpinned npx package via @latest, so the actual code executed may change over time without notice. Because this appears in a quickstart for companion installation, the context makes it more dangerous: users are likely to trust and run it verbatim, amplifying supply-chain exposure.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The code prepends a directory derived from skill discovery logic to sys.path and then imports a module by name with import(). Because candidate paths can come from environment-controlled locations such as LYGO_STACK_ROOT or user-writable skill directories, an attacker who can place a malicious file at the resolved path can achieve arbitrary code execution when commands like analyze, mint, or radar are used.

Content

Scanner excerpt · scripts/lygo_cli.py (reported line 124)May include surrounding context.

python

# Avoid stale module if switching skills
    if module_name in sys.modules:
        del sys.modules[module_name]
    return __import__(module_name)


def cmd_version() -> dict[str, Any]:

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT
HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION
OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE