Security audit

LYGO Context Guard

Security checks across malware telemetry and agentic risk

Overview

This skill is a local-only token budgeting, redaction, and compaction helper with disclosed file access and consent-gated local report writes.

Installers should understand that this skill can read any file path they explicitly pass with --file and will print redacted or compacted content to stdout. Redaction is best-effort pattern matching, so avoid treating it as a compliance-grade secret scanner, and only run it on content you intend the agent to process.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The description and body contain broad activation phrases such as handling 'logs, files, or long chats,' 'context is too large,' and 'save tokens / reduce API cost,' which could cause the skill to trigger on many common requests. Over-broad matching is dangerous because it can route unrelated user content, including sensitive files or tool output, into a skill that processes and may persist data, expanding exposure and increasing the chance of unintended file access or overreach.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: examples/leaky_tool_dump.txt:3

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/context_guard.py:387

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/self_check.py:16