LYGO Excavationpro Music Lattice

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:23 AM UTC
• Version: 1.0.0

Overview

This skill mainly routes users to public music links and provides read-only verification helpers, with documented consent gates for publishing and local stack operations.

Install only if you trust the publisher and the referenced public destinations. Before running the documented npx commands, prefer a pinned or otherwise verified ClawHub CLI version. Set LYGO_STACK_ROOT only to a trusted local LYGO stack, and require explicit human approval before local scans/rebuilds, HF uploads, git pushes, ClawHub publishing, or egg planting.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:28

Finding

Unpinned npm CLI execution through a mutable latest tag

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:28 and SKILL.md:148-150
Vulnerability Type: Supply-chain risk from an unpinned executable dependency
Risk Level: Medium

Vulnerable Code

SKILL.md:28:

bash

npx clawhub@latest install deepseekoracle/lygo-excavationpro-music-lattice

SKILL.md:148-150:

bash

npx clawhub@latest publish "…/clawhub/mirrors/lygo-excavationpro-music-lattice" \
  --slug lygo-excavationpro-music-lattice \
  --name "LYGO Excavationpro Music Lattice"

Technical Analysis

The documented commands use npx to download and execute the clawhub npm package identified by the mutable latest distribution tag. The package version and artifact integrity are not pinned.

Consequently, the code executed by these commands can change after this skill has been reviewed. If the npm package, maintainer account, publishing credentials, or package distribution process is compromised, clawhub@latest could resolve to attacker-controlled code. npm CLI packages and their lifecycle behavior execute with the privileges of the invoking user.

This issue is not automatically triggered by the included Python scripts; exploitation requires a user or agent to follow one of the documented npx commands.

Attack Path

1. An attacker compromises the clawhub package, its maintainer account, or the associated npm publishing credentials.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user follows the installation or publishing instructions in SKILL.md.
4. npx retrieves the current attacker-controlled release.
5. The malicious package executes under the invoking user's account.
6. The payload can access resources available to that user, including project files, environment variables, npm credentials, publishing tokens, and other locally accessible data.

Impact Assessment

Successful exploitation could result i ...[truncated 769 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed version, for example clawhub@X.Y.Z.
2. Manage the CLI through a project dependency and commit a lockfile containing the resolved artifact integrity hash.
3. Install dependencies with a deterministic command such as npm ci, then invoke the verified local binary rather than downloading a mutable package at execution time.
4. Verify npm provenance, package ownership, expected checksums, and release signatures before upgrading the pinned version.
5. Review each version change before updating the pin; do not automatically track distribution tags such as latest.
6. Run installation and publishing operations in an isolated, least-privileged environment with only the credentials required for that operation.
7. Keep publishing tokens short-lived and narrowly scoped, and avoid exposing unrelated secrets to the CLI process.
8. Document the expected package version, publisher identity, and verification procedure alongside both commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a full music portal with catalog, ledger, streaming, live portal, and payment-related capabilities. The supplied code does not implement any of those features. Instead, it performs local environment-variable lookup and filesystem checks to validate a stack root directory. This is a materially different primary purpose from the declared behavior, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises capabilities through free-form metadata and embedded commands but does not declare an explicit tool scope such as permissions or allowed-tools. That ambiguity can cause an agent runtime to over-grant file, environment, or network access, especially since the workflow instructs reading local files, checking environment variables, and contacting external HTTPS resources.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using 'npx clawhub@latest install ...' pulls and executes the most recent package version at runtime, which creates a supply-chain risk if a malicious or compromised release is published. Because this is a direct installation command embedded in the skill, operators may execute it verbatim and unknowingly run unreviewed code.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The maintainer publish command also uses 'npx clawhub@latest', which introduces the same unpinned remote execution risk during publication workflows. Publish paths are especially sensitive because they often run in environments with repository credentials or release authority, increasing blast radius if the fetched package is malicious.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The intent map includes broad, generic trigger phrases such as "listen," "verify," "paypal," and "donate" that could match ordinary user requests and cause the agent to invoke this skill unexpectedly. Because the skill exposes operational actions and external destinations, overbroad routing can lead to unintended navigation, verification routines, or donation-related flows that the user did not explicitly request.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/SECURITY.md (reported line 23)May include surrounding context.

md

| Operation | Gate |
|-----------|------|
| Status / verify / map links | No consent |
| Local vault scan / encode / hub rebuild | Human OK (local disk) |
| HF stream publish | Explicit user request + HF token they control |
| Kernel egg plant | `lygo-kernel-egg-planter` + `--i-consent` |

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/SECURITY.md (reported line 32)May include surrounding context.

md

## Prohibited

- Auto-posting music or links to social without user OK  
- Uploading masters/WAVs to third parties without consent  
- Putting secrets, tokens, or absolute private paths into eggs or skill JSON  
- Claiming “platform-proof” without distinguishing **public streams** vs **local masters**