LYGO OpenClaw (Sovereign Router)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

This skill is a documented command-map alias with a small local self-check; users should be careful with the unpinned installer and only run linked stack tools from a trusted clone.

Install only if you trust the publisher and the LYGO stack clone you point LYGO_STACK_ROOT at. Prefer a pinned clawhub installer version if available, avoid running the installer with elevated privileges, and do not provide Discord tokens, API keys, wallets, or browser credentials unless you intentionally invoke a separate trusted runtime that needs them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:31

Finding

Unpinned npm Installer Is Downloaded and Executed via npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 31–34
Vulnerability Type: Unpinned third-party executable dependency
Risk Level: Medium

bash

npx clawhub@latest install deepseekoracle/lygo-open-claw
# or canonical:
npx clawhub@latest install deepseekoracle/lygo-sovereign-claw

Technical Analysis

The documented installation procedure invokes npx with the mutable clawhub@latest version specifier. If the package is not already available locally, npx can retrieve the currently published package from the npm registry and execute its command-line entry point.

The latest tag is mutable and provides no guarantee that operators will execute the same code that was available when this Skill was audited. The command also does not specify an integrity hash or another mechanism for verifying that the downloaded installer matches a reviewed artifact. Consequently, compromise of the npm package, its publisher account, the distribution channel, or a future release could introduce arbitrary installer behavior.

This finding does not establish that the current clawhub package is malicious. It identifies a supply-chain trust boundary created by downloading and executing an unpinned dependency.

Attack Path

1. An attacker compromises the npm publisher account, package, release process, or another component capable of changing the release referenced by the latest tag.
2. The attacker publishes a modified release and assigns it to clawhub@latest.
3. An operator follows the installation command documented in SKILL.md.
4. npx retrieves and executes the attacker-controlled package entry point.
5. The malicious installer performs actions with the operating-system permissions and environmental access of the invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the privileges of the user running the installation command. Depending on that use ...[truncated 454 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed package version, for example clawhub@X.Y.Z.
2. Verify the package against a trusted integrity digest or signed provenance record before execution.
3. Document the expected publisher, registry, package version, and checksum so operators can independently validate the artifact.
4. Run the installer with least privilege in an isolated environment without unnecessary credentials or sensitive environment variables.
5. Avoid elevated or administrative execution unless it is strictly required and separately justified.
6. Establish a controlled update process in which new installer versions are reviewed before the documented version is changed.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents the skill as a command-routing/consensus/action-identity system component, but the supplied code does not implement routing, consent gating, consensus, action identity, or any runtime behavior. Instead, it only performs a local self-check over repository files and documentation content. While reading references/SECURITY.md is mentioned in the description, the code merely verifies that file exists rather than using it operationally. This is a materially different primary purpose from the declared functionality.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill advertises executable commands and local file-oriented checks, but it does not declare an explicit tool scope such as permissions or allowed-tools. That ambiguity can cause a host agent to infer broader capabilities than intended, increasing the chance of unintended file access when the skill is invoked or composed with other skills.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using npx clawhub@latest install ... pulls and executes the latest published package at runtime, which is a classic supply-chain risk. If the upstream package is compromised or a breaking release is published, operators may execute attacker-controlled code during installation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The alternate install command also uses npx clawhub@latest, creating the same unpinned remote execution path for the canonical slug. This duplicates the supply-chain exposure and broadens the likelihood that users will follow an unsafe install pattern.

Content

No source excerpt is available for this finding.