ClawHub
Back to skill

Security audit

LYGO Kernel Egg Planter

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed, consent-gated local LYGO stack tool, with the main risk being that it intentionally runs tools from a stack directory the user must trust.

Install only if you understand and control the LYGO stack directory you point LYGO_STACK_ROOT or --stack-root at. Prefer --local-only unless you intentionally want external anchoring, and do not place secrets or private repositories into egg payloads because permaweb anchoring can be irreversible.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

subprocess module call

Medium
Category
Dangerous Code Execution
Content
cmd = [sys.executable, str(tool)]
    if extra:
        cmd.extend(extra)
    subprocess.check_call(cmd, cwd=stack)


def main() -> int:
Confidence
92% confidence
Finding
subprocess.check_call(cmd, cwd=stack)

Lp3

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding
The skill invokes local Python scripts, relies on an environment variable (`LYGO_STACK_ROOT`), and describes filesystem and shell-driven operations, but the file itself does not declare concrete permissions in a machine-enforceable way. Even though the text says permissions exist in `claw.json`, the analyzed file exposes capabilities that could let an agent read/write files and execute commands against a user-supplied stack path, which increases risk if the surrounding permission model is absent, stale, or bypassed.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.