LYGO Ollama Army & Assistant Hub

• Outcome: Review
• Latest audit: Aug 6, 2026 · 6:08 AM UTC
• Version: 0.8.2

Overview

The skill is mostly disclosed as a local Ollama automation hub, but several runtime and desktop-launcher paths are broader or less gated than the manifest promises.

Install only if you want a powerful local automation hub and are comfortable reviewing queue files, config flags, and Desktop launchers before use. Treat LYGO_STACK_ROOT as trusted code, avoid running the autonomous/idle/full-capacity launchers casually, and do not enable planting, self_tune, social pulse, external memory writes, or public probes unless you intend those effects.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence
• Finding: The skill markets itself as local-first, consent-gated, and opt-in for public probes, but the finding indicates outbound HTTPS requests may occur by default in sentinel/autonomous paths. That mismatch is security-relevant because operators and downstream agents may rely on the documentation to make trust decisions, causing unintended network egress and broader autonomous activity than expected.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The UI renders Discord and crypto operational status cards unconditionally from the fetched status object, which contradicts the stated default surface that these should not be shown by default. This creates an information exposure issue by advertising the presence, state, and branding of optional integrations to anyone with access to the console, increasing reconnaissance value and potentially encouraging use of features that are meant to remain gated or undisclosed by default.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The installer creates a desktop launcher that hard-codes both LYGO_ARMY_AUTONOMOUS=1 and LYGO_ARMY_I_CONSENT=1 before starting the autonomous supervisor. This collapses a deliberate runtime safety gate into a one-click shortcut, making accidental or uninformed activation of autonomous behavior much easier for anyone with access to the desktop session.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The file-level warning says the desktop launcher requires dual consent, but the generated launcher itself injects the consent values automatically. This mismatch is dangerous because it can mislead reviewers or operators into believing consent is externally enforced when the script actually bypasses that safeguard by construction.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The script unconditionally writes a launcher to the user's Desktop even though the skill metadata states desktop installers should require the LYGO_ARMY_INSTALL_DESKTOP=1 gate. This creates a mismatch between documented safety controls and actual behavior, making installation side effects occur without the promised opt-in check.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The installer is gated by LYGO_ARMY_INSTALL_STEWARD_DESKTOP, while the skill metadata says desktop installers require LYGO_ARMY_INSTALL_DESKTOP=1. This mismatch creates a control-gap where operators may believe one global safety gate governs desktop installation, but this script uses a different variable and can be enabled independently, undermining predictable deployment controls for an external launcher.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The example config sets `sentinel.enabled` to true even though the skill metadata claims sentinel is gated off by default. Users often copy example configs into production, so this discrepancy can silently enable background monitoring behavior contrary to operator expectations and documented safety posture.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The example config enables `idle_guardian` while the manifest states idle/cron behaviors are gated off by default. In an automation-oriented skill, enabling a background role scheduler by default increases the chance of unintended autonomous actions, resource consumption, and trust-boundary violations if operators rely on the documented defaults.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The file declares 'self-tune' inside SAFE_CRON_ROLES, so a self-tune task is seeded every cron tick regardless of the config gate that is supposed to keep self_tune off by default. Even if army_self_tune.py itself no-ops when disabled, queueing and advertising a mutating role as always-safe breaks the documented trust boundary and can lead downstream workers to execute or mishandle a configuration-changing task unexpectedly.

Intent-Code Divergence

Medium

• Confidence: 92% confidence
• Finding: The comment says self_tune is default-false and conditionally run, but the scheduler still unconditionally seeds the self-tune cron role through SAFE_CRON_ROLES. That mismatch is dangerous because operators and reviewers may rely on the comment and manifest while the actual queue behavior exposes a config-mutating capability by default.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The script unconditionally seeds a `public-pages-check` task even though the skill metadata states outbound public probes are opt-in via `LYGO_GENESIS_PROBE_PUBLIC=1`. In an agent/orchestration context, quietly enabling externally oriented checks by default weakens operator consent boundaries and can cause unintended network activity, policy violations, or information disclosure about the local environment.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The idle guardian is presented as safe housekeeping while offline, but it launches configurable general-purpose daemon roles from the main army daemon rather than enforcing a narrow passive-only allowlist. In this skill context, that mismatch is meaningful because the launched roles inherit broader agent behavior, so a permissive or later-modified config can cause unattended autonomous actions beyond expected idle maintenance.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The docstring claims 'No social pulses,' but the code does not enforce any technical prohibition on social-capable roles; it simply loads roles from configuration and starts them. In an agent-orchestration skill, policy-by-comment is insufficient, because unattended execution can drift into externally interactive behavior if config includes such roles or role definitions change over time.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The script advertises itself as a heartbeat-only launcher, but it conditionally executes an additional collector component on every loop when that file exists. This mismatch expands runtime behavior beyond the stated scope, which is risky because operators may run it under the assumption that only the sentinel heartbeat executes, while the collector may gather data or trigger broader side effects.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The module docstring claims 'Heartbeats ONLY' and 'No LLM daemons, no monitoring UI,' yet the code also runs a collector script. Even if the collector is local and benign, deceptive or inaccurate operational messaging is a security concern because it can cause users and reviewers to trust a narrower execution surface than actually exists.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This daemon is described as a local Ollama helper, but `process_task` dispatches many operational roles that launch external scripts across the stack, including audits, housekeeping, planting, self-tuning, and worker tasks. If an attacker can place or influence queue task files, they can trigger privileged maintenance or mutation actions far beyond chat assistance, creating a broad execution surface and violating least privilege.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The `public-pages-check` role invokes `verify_public_pages.py`, which is a network-oriented probe capability. In context, the metadata says public probes should only run when explicitly enabled, but this file contains no local enforcement of such a gate, so queue-driven execution could perform outbound checks unexpectedly.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The `egg-planter`, `registry-planter`, and `self-tune` roles directly execute mutation-oriented scripts without checking the manifest-described OFF-by-default gates. Because tasks are queue-driven, anyone who can enqueue these roles may trigger configuration changes or planting workflows that the skill description claims should require explicit enablement.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: The daemon can execute a wide set of stack tools and maintenance subprocesses unrelated to core local model inference, including integrity tests, audits, sync jobs, and automation workers. This significantly enlarges the attack surface because a task queue intended for assistant work becomes an execution broker for local operational tooling.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The module header and skill metadata emphasize a constrained execution surface, but the implementation exposes many stack and command-center script invocations. This mismatch is dangerous because operators may trust the daemon as low-risk local assistance while it actually supports privileged operational actions, increasing the chance of unsafe deployment.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The task seeder defines privileged roles such as "self-tune", "egg-planter", and "registry-planter" even though the skill metadata says these capabilities are gated off and should never auto-enable planting. Although the code later filters them unless LYGO_ARMY_SEED_PLANTING is explicitly set, bundling and seeding these roles from the same script increases the chance of accidental activation, configuration drift, or downstream components consuming the queued tasks without enforcing the same gates.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The script creates a .bat file on the user's Desktop without any in-script warning, prompt, or confirmation. While not highly severe, silent persistence-like changes to a prominent user location reduce transparency and can normalize unexpected file drops, especially in a skill that already includes installer behavior.

Missing User Warnings

Medium

• Confidence: 74% confidence
• Finding: The supervisor repeatedly runs additional Python scripts for sentinel and cron tasks during idle operation, which expands local automation beyond a single passive monitor. In this skill context, unattended recurring execution increases risk because those downstream scripts may perform broader actions, and the startup messaging does not clearly enumerate or require confirmation for those tasks.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: When `idle_guardian.allow_external_memory_write` is enabled, the script appends content into an external `LYRA_CORE` daily markdown file based on environment/config-selected paths, without an interactive warning or stronger path trust validation. In an autonomous housekeeping context, this can cause unintended modification of external data stores and could be abused to write into an attacker-selected directory if `LYRA_CORE_ROOT` is misconfigured.

Missing User Warnings

Medium

• Confidence: 78% confidence
• Finding: The script can invoke stack-mutating tools when `allow_stack_mutating_tools` is enabled, but there is no additional runtime confirmation or integrity check on the target scripts. In an automated idle/supervisor setting, this raises the risk of silent repository or workspace mutation if configuration is flipped or those tool files are replaced/tampered with.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: genesis_console/data/status.json:13