ClawHub
Back to skill

Security audit

LYGO Guardian P0 Stack

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed local text-safety gate with an optional user-run bridge to a separate LYGO stack, and I found no hidden network use, persistence, data harvesting, or destructive behavior.

Install only if you want a local text/content validation wrapper. Treat LYGO_STACK_ROOT as sensitive configuration: leave it unset for bundled local checks, or set it only to a trusted LYGO stack you intentionally installed and reviewed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (4)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
gate = Path(stack) / "clawhub" / "mirrors" / "lygo-protocol-stack-operator" / "scripts" / "lygo_p0_gate.py"
    if not gate.is_file():
        return -1
    return subprocess.call([sys.executable, str(gate), str(path)])


def text_gate(content: str) -> dict:
Confidence
96% confidence
Finding
return subprocess.call([sys.executable, str(gate), str(path)])

Tainted flow: 'gate' from os.environ.get (line 23, credential/environment) → subprocess.call (code execution)

Medium
Category
Data Flow
Content
gate = Path(stack) / "clawhub" / "mirrors" / "lygo-protocol-stack-operator" / "scripts" / "lygo_p0_gate.py"
    if not gate.is_file():
        return -1
    return subprocess.call([sys.executable, str(gate), str(path)])


def text_gate(content: str) -> dict:
Confidence
99% confidence
Finding
return subprocess.call([sys.executable, str(gate), str(path)])

Lp3

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding
The skill advertises and demonstrates capabilities that can read files, inspect environment state, invoke Python/CLI tooling, and reference external network resources, but it does not declare permissions. Even though much of this appears intended for legitimate security scanning and wrapper use, undeclared capabilities weaken least-privilege guarantees and can surprise hosts that rely on manifest-level permission review before installation or execution.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill is described as a portable text gate, but it can delegate processing to an external script located in an environment-selected stack. That broadens the trust boundary from local validation logic to arbitrary code in another repository, increasing supply-chain and execution risk beyond the stated role.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.