LYGO Lattice Pulse

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.1.0

Overview

The skill is mostly a disclosed plugin install guide, but it asks users to run unpinned remote installers whose resolved code is not included in the reviewed artifact.

Install only if you trust the deepseekoracle publisher and the current ClawHub/npm resolution path. Prefer a pinned version or verified digest, inspect the resolved OpenClaw plugin before enabling it, and run installation in a least-privileged or isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:33

Finding

Unpinned Remote Package Execution and Plugin Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33–35
Vulnerability Type: Unpinned third-party package and plugin installation
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install deepseekoracle/lygo-lattice-pulse
# OpenClaw plugin (when published as plugin package):
openclaw plugins install clawhub:@deepseekoracle/lygo-lattice-pulse

Technical Analysis

The documented installation process invokes npx clawhub@latest, which resolves a mutable package release from an external registry and executes it. The @latest tag does not identify a fixed, previously audited artifact. Consequently, the package executed by a future user may differ from the package available during this audit.

The second command installs an externally hosted OpenClaw plugin without specifying an immutable version, digest, or integrity value. That plugin's implementation is not included in this repository and therefore could not be inspected as part of this audit.

This is a supply-chain weakness rather than evidence that the current local package is malicious. Exploitation requires compromise or malicious control of the relevant registry package, publisher account, release process, or transitive dependency.

Attack Path

1. An attacker compromises the package registry, publisher account, plugin release process, or an applicable dependency.
2. The attacker publishes a malicious release under the mutable latest tag or replaces the remotely resolved plugin artifact.
3. An operator follows the installation commands in SKILL.md.
4. npx downloads and executes the attacker-controlled package with the operator's current privileges, or OpenClaw installs the malicious plugin.
5. The payload can perform actions allowed by the installer process or by the plugin runtime.

Impact Assessment

Successful exploitation could enable arbitrary code execution with the privileges of the user running the installation command. Depending on that us ...[truncated 394 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with a reviewed, exact package version.
• Pin the OpenClaw plugin to an immutable version or content digest.
• Publish and verify cryptographic checksums or signed provenance for installation artifacts.
• Verify the publisher identity and signature before installation.
• Review the resolved plugin artifact and its dependency lockfile before execution.
• Use registry lockfiles or equivalent integrity metadata for all transitive dependencies.
• Perform installation under a least-privileged account or isolated environment.
• Configure the plugin host with minimal filesystem, network, credential, and tool permissions.
• Update the self-check or a separate verification utility to validate artifact signatures and expected digests before installation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description suggests a functional plugin with operational capabilities such as live pulse/status behavior, stack verification, registry comparison, gating, and readiness assessment. The supplied code only performs a simple local integrity check: it ensures a few files exist and that SKILL.md contains the expected skill name. This is a materially different primary purpose from the description. There are no undeclared dangerous capabilities, but the implemented behavior is much narrower and unrelated to most of the declared functionality, so this is a clear description-behavior mismatch.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx clawhub@latest executes the latest published package at install time, which creates a supply-chain risk if a malicious or compromised release is published. Because this skill instructs users to install and trust an external plugin, an attacker could leverage the unpinned dependency to run unintended code on the user's system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.