LYGO LoRa mesh

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 11:25 AM UTC
• Version: 1.0.0

Overview

The packaged skill is a local LoRa pulse codec with no hidden networking, shell execution, radio control, or write behavior in its included scripts, though its install command and optional external stack ingest deserve normal caution.

Before installing, consider pinning or otherwise verifying the ClawHub CLI instead of using `@latest`. The packaged skill itself is local and low-privilege, but only run the separate stack ingest command if you intentionally want it to write the documented `lora_last.json` state file.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:38

Finding

Unpinned ClawHub CLI Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:38, SKILL.md:90, README.md:6
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

Vulnerable Code Snippets

SKILL.md:38:

bash

npx clawhub@latest install deepseekoracle/lygo-lora-mesh

SKILL.md:90:

bash

npx clawhub@latest install deepseekoracle/lygo-lora-mesh

README.md:6:

bash

npx clawhub@latest install deepseekoracle/lygo-lora-mesh

Technical Analysis

The documented installation procedure invokes npx with the mutable @latest tag. When users execute this command, npx may download and run a ClawHub CLI release that was not part of the audited project and whose contents can change after this audit.

No exact package version, package integrity hash, lockfile, or equivalent verification mechanism is supplied. Consequently, the effective installation-time code is controlled by the current state of the external package registry rather than by the reviewed artifact.

This issue does not mean the audited Python scripts are malicious. The reviewed scripts contain no network, subprocess, shell, serial, persistence, or filesystem-write behavior. The risk arises when a user follows the external installation instructions.

Attack Path

1. An attacker compromises the publisher account, package registry, distribution pipeline, or a future release of the clawhub CLI.
2. The attacker publishes a malicious release and causes it to resolve through the latest distribution tag.
3. A user follows the documented npx clawhub@latest install ... command.
4. npx retrieves the mutable package from the external registry.
5. The downloaded CLI or its installation lifecycle executes attacker-controlled JavaScript on the user's machine.
6. The malicious code operates with the privileges and environmental access of the user who invoked npx.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the inst ...[truncated 526 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace @latest with an exact, reviewed CLI version:

bash

npx clawhub@1.2.3 install deepseekoracle/lygo-lora-mesh

2. Publish and verify the expected package integrity digest before execution. Where supported, use a lockfile or registry integrity metadata to bind installation to known package bytes.
3. Document the trusted package registry explicitly and disable fallback to untrusted or user-controlled registries in automated environments.
4. Prefer a separately verified installation of the ClawHub CLI, followed by invocation of that pinned local binary.
5. In CI environments, run installation with a dedicated unprivileged account, minimal environment variables, restricted filesystem access, and restricted network access.
6. Establish a release process that updates the pinned version only after reviewing the new CLI release and recording its integrity value.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Scope Creep

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest declares filesystem access as optional read-only, but later documentation states that ingest writes data/living_mesh/lora_last.json. Permission declarations are a core trust signal; understating write capability can cause the skill to be approved or executed under false assumptions, enabling unauthorized local state modification.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to run npx clawhub@latest install ..., which fetches and executes the latest published package version rather than a pinned, reviewed release. If the package or one of its dependencies is compromised or a breaking/malicious update is published, users could execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using npx clawhub@latest install ... executes whatever version is current at install time, which creates a supply-chain trust problem. If the upstream package is compromised or a breaking/malicious release is published, users may run attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This repeats the same unpinned npx clawhub@latest installation pattern, again exposing users to supply-chain compromise at execution time. The danger is not in the LoRa logic itself but in telling users to fetch and run an ever-changing package with no version lock.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill repeatedly claims scripts are encode/decode/compare only, yet the documentation also advertises an ingest mode that writes local state. That inconsistency weakens the trust boundary and can mislead users or policy engines about what the skill actually does, which is dangerous in security-sensitive environments.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.