LYGO Network Builder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:49 AM UTC
• Version: 1.2.0

Overview

The skill is mostly transparent about verifying LYGO anchor data, but installation and verification depend on mutable or user-selected external code that is not pinned or verified.

Install only if you trust both the ClawHub installer source and the lygo-protocol-stack checkout you point LYGO_STACK_ROOT at. Prefer a pinned installer version and a verified stack revision before running the wrapper, because the verifier script will execute with your normal local permissions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:30

Finding

Execution of an Unpinned Mutable npm Package During Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 30
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Vulnerable code:

bash

npx clawhub@latest install deepseekoracle/lygo-network-builder

Technical Analysis

The documented installation procedure directs users to execute the mutable latest version of the clawhub npm package through npx. The command does not pin an audited package version, verify a cryptographic digest, use a lockfile, or validate a signed release.

Because npx can download and execute the selected package, the code that runs during installation may differ from the code available when this Skill was audited. Compromise of the package publisher, npm account, package distribution channel, or a future latest release could introduce arbitrary installation-time behavior.

Attack Path

1. An attacker compromises the npm package, its publisher account, or the relevant distribution process.
2. The attacker publishes a malicious release that becomes the package's latest version.
3. A user follows the installation command from SKILL.md.
4. npx downloads and executes the attacker-controlled package.
5. The malicious package runs with the operating-system privileges and environment access of the invoking user.

Impact Assessment

Successful exploitation can provide arbitrary code execution under the installing user's account. Depending on that account's privileges and environment, the payload could read or modify accessible files, obtain environment variables or local credentials, alter developer tooling, install additional software, or compromise source repositories.

The audited project does not itself contain such a payload; the risk arises from executing a mutable and unverified dependency.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly audited package version.
• Verify the package using a documented cryptographic integrity hash or signed release.
• Prefer installation through a committed lockfile using a reproducible package-manager command.
• Document the expected package publisher, version, and integrity value.
• Review package lifecycle scripts before installation and disable them where they are not required.
• Establish a controlled update process in which new versions are reviewed before changing the pinned version.

T08 · Insecure Dependencies

Error

• Location: scripts/verify_anchors.py:12

Finding

Execution of Unverified Python Code from a User-Selected Stack Directory

Content

View full analysis

Vulnerability Details

File Location: scripts/_stack_paths.py, lines 10–31; scripts/verify_anchors.py, lines 12–16
Vulnerability Type: T08: Insecure Dependencies
Risk Level: High

Stack-path validation code:

python

def resolve_stack_root(explicit: str | None = None) -> Path:
    if explicit:
        p = Path(explicit).resolve()
        _assert_stack(p)
        return p
    env = os.environ.get("LYGO_STACK_ROOT", "").strip()
    if env:
        p = Path(env).resolve()
        _assert_stack(p)
        return p
    for anc in SKILL_ROOT.parents:
        if (anc / "tools" / "lygo_network_builder_verify.py").is_file():
            _assert_stack(anc)
            return anc
    raise SystemExit("Set LYGO_STACK_ROOT to a lygo-protocol-stack clone")


def _assert_stack(p: Path) -> None:
    required = [
        p / "tools" / "lygo_network_builder_verify.py",
        p / "docs" / "network_builder" / "IMMUTABLE_ANCHORS.json",
    ]
    missing = [str(x.relative_to(p)) for x in required if not x.is_file()]
    if missing:
        raise SystemExit(f"Invalid stack root {p}; missing: {missing}")

External-script execution code:

python

def main() -> int:
    root = resolve_stack_root()
    script = root / "tools" / "lygo_network_builder_verify.py"
    cp = subprocess.run([sys.executable, str(script)], cwd=root, check=False)
    return cp.returncode

Technical Analysis

resolve_stack_root() accepts a directory selected through the LYGO_STACK_ROOT environment variable. _assert_stack() establishes only that two expected file paths exist. It does not validate the repository's origin, revision, cryptographic signature, file digest, ownership, or permissions.

verify_anchors.py then invokes tools/lygo_network_builder_verify.py from that directory with the current Python interpreter. A malicious directory can therefore satisfy the filename checks wh ...[truncated 1418 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the external stack to an approved repository revision or release.
• Verify a signed commit, signed release, or cryptographic manifest before executing any stack script.
• Store and validate the expected digest of tools/lygo_network_builder_verify.py.
• Reject stack directories with unsafe ownership or permissions, such as directories writable by untrusted users.
• Resolve and validate the canonical path before use and require it to be inside an explicitly approved repository location.
• Consider moving the required verifier into the audited Skill package rather than executing code from an external directory.
• If external execution remains necessary, run the verifier in a sandbox with restricted filesystem, environment, network, and subprocess permissions.
• Clearly document that LYGO_STACK_ROOT is a code-execution trust boundary and must never reference an untrusted clone.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description suggests an active cartographer/verifier skill that loads anchor data, performs live verification, and supports discovery workflows. The supplied code chunk does none of those substantive tasks. It only finds a repository root and asserts that two expected files exist. While this supports the broader workflow, the actual behavior of the chunk is materially narrower and does not implement the key described capabilities. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description promises a specific cartographer/verification role centered on immutable anchors and traversal discovery. The provided code chunk does not implement those behaviors directly; instead, it simply launches another verification script in the stack. While that external script might conceivably perform some of the described tasks, this supplied code chunk itself only acts as a wrapper. Based on the provided code alone, the actual behavior is materially different/narrower than the declared purpose, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares filesystem, subprocess, and limited network capabilities in free-form metadata but does not define an explicit enforceable tool permission scope such as allowed-tools/permissions. That creates ambiguity for a host agent and can lead to overbroad shell or environment access beyond what the description intends, especially because the workflow instructs execution of local Python scripts and network probes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Using npx clawhub@latest install ... pulls whatever version is current at execution time, making the install non-reproducible and exposing users to supply-chain compromise or unexpected behavior changes. In a security-sensitive skill that later instructs subprocess execution and verification, an unpinned package manager invocation materially increases risk.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

The file presents itself as a simple skill wrapper for verification, but its implementation delegates execution to another script through subprocess.run. For a network cartographer/verification skill, launching a child process is not obviously required from this wrapper layer and expands capability beyond straightforward in-process orchestration.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/verify_anchors.py (reported line 16)May include surrounding context.

python

def main() -> int:
    root = resolve_stack_root()
    script = root / "tools" / "lygo_network_builder_verify.py"
    cp = subprocess.run([sys.executable, str(script)], cwd=root, check=False)
    return cp.returncode

Static analysis

No suspicious patterns detected.