Security audit
LYGO Mint Walkthrough
Security checks across malware telemetry and agentic risk
Overview
This skill is a local tutorial that hashes user-chosen files and writes a consent-gated local ledger, with no evidence of network use, auto-posting, or hidden privilege.
Installers should understand that this skill can read any pack file path they provide and can store local ledger metadata, including absolute file paths and anchor IDs, under the skill state directory when they consent. It does not appear to post content, use the network, spawn subprocesses, or collect credentials.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
65/65 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.