LYGO-MINT Operator Suite (v2)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:58 PM UTC
• Version: 1.0.0

Overview

The skill mostly performs local pack hashing and receipt generation, but it needs review because some scripts can write outside the intended workspace, follow symlinks in packs, and run unverified local helper code if invoked.

Review before installing. Run it only on trusted pack folders, avoid elevated privileges, check where state/reference outputs will be written in your environment, and avoid the legacy mint_pack_local.py wrapper unless the external tools it calls are known and pinned. Treat generated ledgers as mutable local records, not independent proof by themselves.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/mint_pack_v2.py:29

Finding

Incorrect Workspace Root Resolution Causes Out-of-Project Filesystem Writes

Content

View full analysis

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: scripts/mint_pack_local.py:35

Finding

Legacy Mint Wrapper Executes Unverified External Python Tools

Content

View full analysis

subprocess.CompletedProcess: return subprocess.run([sys.executable, str(path), *args], cwd=str(ROOT), capture_output=True, text=True) ``` ```python # Mint using existing tool mint_tool = ROOT / "tools" / "lygo_mint" / "mint_pack.py" if not mint_tool.exists(): raise SystemExit(f"Missing mint tool: {mint_tool}") # Expect mint tool to output JSON or text; we treat stdout as the minted record if JSON. # Workspace mint tool expects positional pack_path proc = run_py(mint_tool, [str(pack_path), "--version", args.version, "--champion", args.champion or "", "--anchor", args.anchor or ""]) ``` ```python # Canonicalize ledger canon_tool = ROOT / "tools" / "lygo_mint" / "canonicalize_ledger.py" if canon_tool.exists(): _ = run_py(canon_tool, []) ``` ### Technical Analysis The wrapper executes `mint_pack.py` and `canonicalize_ledger.py` from an external `tools/lygo_mint` directory that is not part of the audited Skill package. It validates only whether the files exist; it does not verify ownership, permissions, a pinned cryptographic digest, or an authenticated package version. As a result, the effective code executed by the Skill can change independently after review. Any actor who can create or replace one of the expected files can cause arbitrary Python code to run with the operator's privileges. The invocation uses a subprocess argument array and does not enable a shell, so direct shell-metacharacter injection through command-line arguments was not identified. The vulnerability instead arises from trusting the executable script path. The incorrect root calculation compounds the issue in the audited layout by resolving the expected tools under `/tools/lygo_mint/`. ### ...[truncated 1130 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: scripts/bundle_pack_v2.py:35

Finding

Pack Processing Follows File Symlinks Outside the Selected Directory

Content

View full analysis

Tuple[Path, List[Path]]: if input_path.is_file(): root = input_path.parent return root, [input_path] root = input_path files: List[Path] = [] for dirpath, _, filenames in os.walk(root): for fn in filenames: fp = Path(dirpath) / fn # skip common noise if fn in {".DS_Store"}: continue if "__pycache__" in fp.parts: continue files.append(fp) files.sort(key=lambda x: relpath_posix(root, x)) return root, files ``` ```python def hash_file(root: Path, p: Path) -> Dict: raw = p.read_bytes() ``` ### Technical Analysis Neither pack traversal implementation rejects symbolic links or confirms that each resolved file remains beneath the selected input root. Although `os.walk()` does not follow symlinked directories by default, it can enumerate a symbolic link that appears as a file. Calling `Path.read_bytes()` then follows the link and reads the target. A pack can therefore contain a path ...[truncated 1649 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/verify_pack_v2.py:30

Finding

Verifier Cannot Reproduce Hashes Using the Documented Workflow

Content

View full analysis

` ``` Minting requires and hashes title, version, and author: ```python ap.add_argument("--title", required=True) ap.add_argument("--version", required=True, help="YYYY-MM-DD.vX") ap.add_argument("--author", default="DeepSeekOracle") ``` ```python manifest = { "lygo_mint": {"v": 2, "canon": CANON_RULESET}, "meta": { "title": args.title, "version": args.version, "author": args.author, }, "tags": [t.strip() for t in args.tags.split(",") if t.strip()], "files": file_records, } canon_manifest = canonical_manifest(manifest) pack_sha = sha256_text(canon_manifest) ``` Verification substitutes `None` for omitted metadata: ```python ap.add_argument("--title", default="") ap.add_argument("--version", default="") ap.add_argument("--author", default="") ap.add_argument("--tags", default="LYGO,Δ9Council") ``` ```python manifest = { "lygo_mint": {"v": 2, "canon": CANON_RULESET}, "meta": {"title": args.title or None, "version": args.version or None, "author": args.author or None}, "tags": [t.strip() for t in (args.tags or "").split(",") if t.strip()], "files": file_records, } canon = canonical_manifest(manifest) got = sha256_text(canon) ok = (got.lower() == args.pack_sha256.lower()) ``` ### Technical Analysis The pack hash covers metadata in addition to file records. A pack minted with a required title and version and the default author therefore cannot normally be reproduced by the documented verification ...[truncated 1459 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/backfill_anchors.py:23

Finding

Anchor Backfill Allows Semantically Invalid Ledger Records

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad operator suite with multiple core functions: pack canonicalization, hashing, dual-ledger output, anchor snippet generation, and pack verification. The supplied code chunk does not implement those functions. Instead, it is a single-purpose backfill tool that appends an anchor_update entry to state/lygo_mint_ledger.jsonl using CLI-provided values. While append-only ledger behavior is loosely consistent with part of the description, the actual primary purpose is materially narrower and different from the declared suite capabilities. Therefore, the description does not accurately represent this code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a broad, advanced LYGO-MINT suite with multiple trust/anchoring functions: canonicalization, hashing, ledger production, anchor snippet generation, and verification. The supplied code chunk performs only one narrow task: creating a deterministic-style zip bundle from a directory by sorting files and fixing zip timestamps. While this may support part of a bundling/canonicalization workflow, it does not implement most of the declared capabilities and its primary behavior is substantially narrower than the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description presents a broad operator suite with multiple core capabilities: pack canonicalization, hash generation, ledger writing, machine-readable snippet generation, and third-party verification. The supplied code only implements a narrow subset: it parses CLI arguments, optionally reads a canonical ledger JSON file, extracts matching metadata for a provided hash, and prints a portable text anchor snippet template. It does not create or update ledgers, does not compute hashes, does not canonicalize multi-file packs, and does not verify third-party packs. This is a material description-behavior mismatch because the code chunk's actual purpose is much narrower than the declared suite.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The declared description presents a broad 'operator suite' with several substantive capabilities: canonicalizing packs, computing hashes, writing ledgers, generating snippets, and verifying packs. The supplied code only formats and prints an anchor snippet from command-line arguments, with minimal platform-specific handling for Discord code fences. It does not inspect files, compute hashes, canonicalize content, write any ledger files, or verify external packs. While snippet generation is one stated capability and the supported platforms align with the description, the overall declared purpose materially overstates what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broad 'Advanced LYGO-MINT Operator Suite (v2)' with multiple capabilities: multi-file pack canonicalization, per-file and bundle hashing, canonical and append-only ledgers, machine-readable multi-platform anchor snippets, and third-party verification. The supplied code chunk is much narrower. It accepts a single --pack path, invokes an external mint_pack.py tool, records the returned output into a JSONL ledger, optionally runs canonicalize_ledger.py, and prints a simple text anchor snippet. It does align partially with ledger writing and canonical ledger updating, but the major advertised capabilities are not implemented in this chunk: there is no multi-file orchestration logic, no per-file hash generation, no bundle hash logic, no verification workflow, and no distinct multi-platform snippet generation beyond plain console text. Therefore the code's actual behavior is materially narrower than the declared purpose.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Most of the declared behavior is represented: the code accepts a file or directory, canonicalizes text files, computes per-file hashes and a bundle-level manifest hash, and writes both append-only and canonical ledger artifacts. However, the description materially overstates two capabilities. First, it says the suite can verify third-party packs, but this code only mints/records a pack and contains no verification workflow or validation logic against external packs. Second, it advertises machine-readable multi-platform Anchor Snippets across specific platforms, but the implementation emits one generic newline-delimited snippet embedded in JSON, with no platform-specific formatting for MoltX/Moltbook/X/Discord/4claw. Therefore the description does not accurately match the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a broad operator suite with multiple capabilities: pack canonicalization, per-file and bundle hash generation, ledger writing, anchor snippet production, and third-party pack verification. The supplied code chunk only implements the verification portion. It computes hashes and canonicalizes a manifest as part of verification, but does not write ledgers, generate anchor snippets, or expose the broader suite functionality described. Since the described primary purpose is substantially broader than the actual behavior of this code chunk, the description does not accurately represent what this specific supplied code does.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill advertises shell, file read, and file write driven workflows but declares no explicit tool scope or permission boundaries. That creates an avoidable trust gap: an agent may be induced to perform filesystem mutations or shell execution without a narrowly defined allowlist, increasing the chance of unintended command execution or writes outside the expected workspace.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/mint_pack_local.py (reported line 36)May include surrounding context.

python

def run_py(path: Path, args: list[str]) -> subprocess.CompletedProcess:
    return subprocess.run([sys.executable, str(path), *args], cwd=str(ROOT), capture_output=True, text=True)


def main() -> None:

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script appends to and overwrites files under workspace-controlled state/reference directories as part of normal execution, without any confirmation, dry-run mode, or explicit warning to the caller. In an agent-skill context, this is security-relevant because running the skill mutates persistent workspace state and could overwrite ledger/canonical records or create durable artifacts without the operator fully realizing it.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.