Security audit

lygo-lpis

Security checks for vulnerabilities and agentic risk

Overview

The skill is for local prompt analysis and mostly discloses its sensitive data handling, but its setup and self-check rely on unpinned or unaudited external code.

Install only if you are comfortable auditing the referenced LYGO stack yourself. Pin the installer version, inspect the external tools and lygo_lpis modules before running them, run in a least-privileged environment, and do not ingest confidential or third-party prompts unless you have explicit authorization.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:48
Finding: Mutable external package and unaudited installer execution
Content: View full analysis
Remediation: View remediation
install deepseekoracle/lygo-lpis ``` 2. Pin all transitive dependencies using an appropriate lockfile. 3. Publish and verify cryptographic checksums or signed release attestations before execution. 4. Include `tools/install_lygo_lpis.py` and the complete LPIS runtime in the artifact submitted for audit. 5. Ensure the installed code is byte-for-byte identical to the reviewed release. 6. Avoid automatically executing code immediately after retrieval. Separate download, integrity verification, inspection, and execution into distinct steps. 7. Run installation with a dedicated, least-privileged account that cannot access unrelated credentials or sensitive files. 8. Update the setup instructions so they enforce the version-pinning policy already described in the security documentation. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/self_check.py:10
Finding: Self-check imports executable modules from an uncontrolled external path
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill describes operational behaviors that rely on local file access and explicitly instructs reading local security documents and handling local prompt vault data, but it does not declare a tool/permission scope. That mismatch weakens least-privilege guarantees and can cause an agent platform to grant broader access than users expect or to execute with ambiguous capabilities.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using npx clawhub@latest install ... pulls and executes the latest published package version at install time, which creates a supply-chain risk if the package is compromised or a breaking/malicious release is published. In a security-sensitive skill that handles confidential prompt material, executing unpinned remote code materially increases the chance of environment compromise or data exposure.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.