ClawHub
Back to skill

Security audit

LYGO LoRa mesh

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to be a narrow local LoRa pulse encoder/decoder, with no hidden network, device-control, or persistence behavior found.

Before installing, understand that this is a local codec/helper for LY1 LoRa text pulses, not a radio driver or firmware tool. Avoid running the installer with elevated privileges, and use a pinned ClawHub installer version or verified installation path if your environment requires reproducible supply-chain controls.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
README.md:6
Finding
Unpinned npm Installer Allows Mutable Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:6` - `SKILL.md:38` - `SKILL.md:90` - `scripts/lygo_lora.py:25` **Vulnerability Type**: Execution of an unpinned third-party installer **Risk Level**: Medium ### Complete Code Snippets `README.md:6`: ```bash npx clawhub@latest install deepseekoracle/lygo-lora-mesh ``` `SKILL.md:38`: ```markdown **Install:** `npx clawhub@latest install deepseekoracle/lygo-lora-mesh` ``` `SKILL.md:90`: ```bash npx clawhub@latest install deepseekoracle/lygo-lora-mesh ``` `scripts/lygo_lora.py:25`: ```python INSTALL = "npx clawhub@latest install deepseekoracle/lygo-lora-mesh" ``` ### Technical Analysis The documented installation workflow instructs users to execute `clawhub@latest` through `npx`. When the package is not already available locally, `npx` can retrieve it from the configured npm registry and execute its package code. The `latest` distribution tag is mutable and does not identify the exact version reviewed during this audit. The project does not supply a lockfile, package integrity hash, cryptographic verification procedure, or exact `clawhub` version for this command. The effective installation code can therefore change independently of the audited artifact. Although the Python scripts inside this project do not perform network access or process execution, the installation command expands the trust boundary to third-party code that was not included in this review. The constant in `scripts/lygo_lora.py` does not execute the command by itself, but it reproduces the unsafe installation instruction in generated output. ### Attack Path 1. An attacker compromises the `clawhub` npm publisher account, registry package, release process, or another component of the package distribution chain. 2. The attacker publishes a malicious release and assigns or causes the mutable `latest` tag to resolve to that release. 3. A user follows the installation instructions and runs: ```bash npx clawhub@late ...[truncated 1306 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Replace the mutable `latest` tag with an exact, reviewed version: ```bash npx clawhub@<reviewed-exact-version> install deepseekoracle/lygo-lora-mesh ``` 2. Pin all transitively resolved installation dependencies through an appropriate lockfile or equivalent immutable dependency manifest. 3. Verify package integrity before execution. Where supported, publish and validate registry integrity metadata, cryptographic checksums, or signed release attestations. 4. Document the expected npm registry, package publisher, exact package version, and integrity value so users can detect registry substitution or publisher changes. 5. Avoid recommending elevated execution. Explicitly instruct users not to run the installer with `sudo` or an administrator account. 6. Consider a download-then-verify workflow rather than allowing `npx` to retrieve and immediately execute a mutable package. 7. Update every occurrence consistently, including `README.md`, `SKILL.md`, and the `INSTALL` string in `scripts/lygo_lora.py`. 8. Re-audit the pinned installer release and its dependency tree whenever the pinned version is intentionally upgraded. ]]>

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (1)

Vague Triggers

Medium
Confidence
82% confidence
Finding
The trigger scope is broader than the implementation scope: it says to use the skill when the user wants Meshtastic, LoRa, off-grid mesh, or RF gossip, even though the package is only a narrow RF codec. Overbroad routing can cause the agent to invoke this skill in unrelated contexts, increasing the chance of misleading output, unsafe operational advice, or unintended file-processing behavior outside the codec's intended use.

Static analysis

No suspicious patterns detected.