Security audit
LYGO Flame Ward
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a local, consent-gated scanning tool with no evidence of hidden network access, destructive actions, or background persistence.
Before installing, understand that this skill can label or gate content using local heuristics and may produce false positives. Use it as an aid for review, not as a medical, legal, identity, or final truth authority. Only pass files or skill directories you intend it to inspect, and only use --i-consent when you want it to write local quarantine or receipt JSON files.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep