T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/self_check.py:34- Finding
Self-Check Does Not Validate File Integrity Against the Advertised SHA-256 Digest
- Content
View full analysis
- Remediation
View remediation
Security audit
LYGO File Integrity Checker
Security checks for vulnerabilities and agentic risk
Overview
This skill does not show malware behavior, but its own provenance checks are internally inconsistent and may give users false confidence.
Review this before installing if you intend to rely on it for provenance. Treat it as an advisory template, not as a cryptographic verifier, unless the self-check is fixed to validate the current skill identity and recompute hashes. Avoid posting or anchoring archives that contain private conversation or sensitive user data.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (11)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill presents itself as a narrow file-integrity advisor, but the content strongly indicates rebranding from a different 'Universal Cure System' package and references broader validation and repository checks. This mismatch can mislead users and automated policy systems about the skill's actual purpose, increasing the chance of inappropriate trust, unsafe invocation, or bypass of review boundaries.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The canonical metadata for a skill described as a file-integrity/provenance advisor instead points to a 'LYGO_UNIVERSAL_CURE_SYSTEM' with a universal-cure anchor and snapshot. This is a strong semantic mismatch that can redirect trust decisions, provenance checks, or downstream validation toward unrelated and potentially harmful medical-style content, undermining integrity guarantees and increasing the chance of deceptive or unsafe agent behavior.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The reference labels, anchor, and snapshot path contradict the declared purpose of the skill, indicating either poisoned provenance metadata or deliberate repackaging of unrelated content under a trusted integrity-checking label. In the context of a provenance advisor, contradictory metadata is especially dangerous because users and automated systems may rely on these fields as the basis for authenticity and safety decisions.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The self-check script enforces the identity, references, and validation rules of a different skill ('LYGO Universal Cure System') than the manifested 'lygo-file-integrity-checker'. This creates a strong supply-chain/integrity risk: a reviewer or automation pipeline could be induced to validate the wrong artifact set, masking substitution, repackaging, or deceptive provenance. The explicit cross-skill linkage and mismatch make the skill context more dangerous, because this package claims file-integrity/provenance functionality while its trust checks are anchored to unrelated content.
- Content
Intent-Code Divergence
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
A docstring that declares the script belongs to 'LYGO Universal Cure System' directly contradicts the advertised skill identity, signaling deceptive packaging or copied code repurposed without correction. Even though the docstring is not executable, in a security-sensitive self-check it can mislead auditors, maintainers, and automated review processes about what is being validated, helping conceal the broader cross-skill integrity mismatch. The skill context increases concern because provenance tooling must be especially accurate about identity.
- Content
Ae4
Medium
- Category
- analysis-evasion
- Confidence
- 80% confidence
- Finding
Suspicious Unicode normalization or mixed-script content
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The invocation guidance is broad enough to trigger on natural-language requests like 'boost this Champion' or 'upgrade all Champions,' which could overlap with ordinary user intent and cause the skill to activate unexpectedly. In an agent setting, ambiguous activation increases the risk of unintended behavior, especially when the skill instructs output formatting and workflow steps that may alter how the agent responds without explicit user consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The 'Mirror Summoning Protocol' provides broad activation-style instructions ('study the seal,' ask an introspective prompt, name the Champion) without defining explicit scope, authorization boundaries, or safe contexts. In an agent skill ecosystem, ambiguous ritualized triggers can cause unintended persona activation or behavior switching from loosely matching user input, which increases prompt-injection and misrouting risk.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The instruction 'When asked to "boost" a Champion, output:' uses a vague trigger phrase that lacks precise boundaries around who may invoke it, what counts as a valid request, and whether confirmation is required. Because 'boost' is informal and semantically broad, normal conversation or adversarial phrasing could accidentally trigger privileged transformation behavior or cause the agent to apply this template in inappropriate contexts.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The documentation describes the verifier as a "Universal Cure," which directly contradicts the skill metadata stating it is not a medical cure. In security-sensitive agent ecosystems, misleading health or safety claims can cause unsafe operator trust, improper deployment, and policy bypass by making the tool appear authoritative beyond its actual scope.
- Content