ClawHub
Back to skill

Security audit

LYGO CLI Bridge

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local CLI bridge whose network access, file reads, optional writes, and companion-skill imports fit its stated purpose.

Install this only with trusted companion skills and keep LYGO_STACK_ROOT pointed at directories you control. Avoid passing private logs or mail into analysis unless you have consent, and review any --out-json or mint output path before using --i-consent.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Content
# Avoid stale module if switching skills
    if module_name in sys.modules:
        del sys.modules[module_name]
    return __import__(module_name)


def cmd_version() -> dict[str, Any]:
Confidence
89% confidence
Finding
return __import__(module_name)

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.