ClawHub
Back to skill

Security audit

LYGO Continuum

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly local and purpose-aligned, but it needs review because claims or capsules can make it probe files outside the intended project boundary despite documentation implying confinement.

Review claim files and capsules before running verify, seal, drift, or handoff, especially if they came from another person or agent. Prefer passing an explicit --base for the intended project and avoid the remote portal for sensitive files unless you independently trust that site.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
92% confidence
Finding
The quickstart instructs users to open a remote web portal even though the skill metadata emphasizes 'Pure local stdlib. No network' operation. This creates a trust-boundary violation and can mislead users into pasting capsules or dropping local files into a third-party website, exposing sensitive project data and undermining the claimed local-only security model.

Description-Behavior Mismatch

High
Confidence
97% confidence
Finding
The module documentation promises that writes are limited to the skill's state/ directory and gated by --i-consent, but the CLI actually permits arbitrary writes to any path supplied via --out for seal, verify, and card. In an agent context, downstream systems may trust the documented safety boundary and allow this skill to run with broader filesystem access, enabling unintended overwrite of user files outside the declared sandbox.

Intent-Code Divergence

Medium
Confidence
90% confidence
Finding
The comment states globbing is safely confined under base/cwd, but root.glob(pattern) will honor patterns containing parent traversal or absolute-style path components, allowing enumeration of files outside the intended project root. In this skill, claims are attacker-controlled input, so a crafted capsule or claims file could cause the tool to inspect and disclose metadata about surrounding filesystem contents during verification or sealing.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.