ClawHub
Back to skill

Security audit

LYGO Docker Deploy

Security checks for vulnerabilities and agentic risk

Overview

The skill is coherent for deploying a local node, but it asks users to execute unpinned remote code and an unpinned installer with Docker-level impact.

Review this carefully before installing. Use a pinned, reviewed commit of the GitHub repository and a pinned ClawHub installer version, inspect Docker Compose files, setup scripts, mounts, network exposure, and cleanup commands, and run it only in an environment where Docker-level access is acceptable.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
SKILL.md:18
Finding

Execution of Mutable Code from an Unpinned Remote Repository

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18–21 and 38–39
Vulnerability Type: T03: Remote Payload Retrieval and Execution
Risk Level: High

Vulnerable Code:

bash
git clone https://github.com/DeepSeekOracle/lygo-protocol-stack.git
cd lygo-protocol-stack
docker compose build lygo-node
docker compose up -d lygo-node
bash
bash setup.sh   # or setup.ps1 on Windows
python tools/node_api_server.py --host 127.0.0.1 --port 8787

Technical Analysis

The instructions clone the default branch of an external GitHub repository without selecting an immutable commit or verifying a cryptographic signature or checksum. They then execute repository-controlled content through Docker Compose, a shell setup script, or a Python program.

The effective payload can consequently change after this Skill has been reviewed. A malicious or compromised repository revision could alter Dockerfile, Compose configuration, setup.sh, Python modules, build dependencies, container entry points, volume mounts, or runtime privileges. The safety statement concerning public port exposure and registry pushes does not address this supply-chain risk.

Attack Path

  1. An attacker compromises the external repository, a maintainer account, or the repository's default branch.
  2. The attacker modifies the Docker build context, Compose file, setup.sh, or Python application.
  3. A user follows the Skill and clones the current default branch.
  4. The user runs either the Docker commands or the non-Docker setup commands.
  5. The modified content executes with the permissions available to Docker or the invoking user.
  6. Depending on the runtime configuration, the payload may modify local files, access mounted data, execute additional network requests, or create attacker-controlled containers.

Impact Assessment

The direct execution scope is the invoking user's account. The Docker path may additionally ...[truncated 409 chars]

Remediation
View remediation

Remediation Suggestions

  • Pin the repository to a reviewed, immutable commit SHA rather than using the mutable default branch.
  • Verify the selected revision using a trusted cryptographic signature or a separately distributed checksum.
  • Provide explicit commands that check out and verify the approved revision before any build or execution.
  • Audit the pinned Dockerfile, Compose files, setup scripts, Python code, images, dependency locks, volume mounts, capabilities, and network configuration.
  • Require Docker containers to run as a non-root user with read-only filesystems, dropped Linux capabilities, restricted networks, and only essential mounts.
  • Do not mount the Docker socket or sensitive host directories into containers.
  • Avoid invoking setup.sh until its pinned contents and downloaded dependencies have been reviewed.
  • Publish controlled upgrades as newly reviewed versions instead of silently following changes to the default branch.

T08 · Insecure Dependencies

Error
Location
SKILL.md:48
Finding

Unpinned npm Installer Execution Through the Latest Distribution Tag

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 48
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable Code:

bash
npx clawhub@latest install deepseekoracle/lygo-docker-deploy

Technical Analysis

The installation command instructs npx to obtain and execute the package selected by the mutable latest distribution tag. This prevents the audited Skill from guaranteeing which version of the installer will run. A future package release, registry compromise, maintainer-account compromise, or malicious transitive dependency could change the executed code without modifying SKILL.md.

Because npx executes the downloaded CLI under the current user's identity, this is an executable supply-chain boundary rather than a passive package download. The command also lacks an integrity value or lockfile that would allow users to verify that they obtained an audited artifact.

Attack Path

  1. An attacker compromises the npm package, its maintainer credentials, its publication pipeline, or a dependency used by the installer.
  2. The attacker publishes malicious code under a version selected by the latest tag.
  3. A user executes the documented npx clawhub@latest command.
  4. npx retrieves and runs the attacker-controlled package version.
  5. The malicious CLI or package lifecycle behavior executes with the invoking user's permissions and may install additional attacker-controlled content.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Accessible files, authentication material, development credentials, environment variables, and network resources could be affected. If the command is run by an administrator or in a privileged CI environment, the impact expands to those privileges and any secrets available to that environment.

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Verify the package using npm integrity metadata, a trusted lockfile, or a separately published cryptographic digest.
  • Review the selected package version, its lifecycle scripts, CLI entry point, and complete transitive dependency tree before recommending execution.
  • Run the installer from an unprivileged account in a constrained environment.
  • Disable lifecycle scripts where compatible with the installation workflow.
  • Treat upgrades as separate security-review events rather than automatically following the latest tag.
  • Prefer a trusted, preinstalled installer or a reproducibly built and signed installation artifact.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Ae4

Medium
Category
analysis-evasion
Confidence
80% confidence
Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

cd lygo-protocol-stack docker compose build lygo-node docker compose up -d lygo-node curl -s http://127.0.0.1:8787/health curl -s http://127.0.0.1:8787/badge curl -s http://127.0.0.1:8787/gossip

text

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

Using npx clawhub@latest install ... executes the latest published package version at install time, which is a supply-chain risk because a compromised or malicious upstream release would be run immediately on the user's system. The skill explicitly instructs installation this way, so it meaningfully increases exposure to unreviewed code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.