LYGO PC Lattice Hardening

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:41 AM UTC
• Version: 1.1.0

Overview

This is a disclosed advisory checklist skill with no bundled system-changing behavior, though its install command should be treated with normal supply-chain caution.

Before installing, consider using a pinned ClawHub installer version or another verified installation workflow instead of a mutable latest tag. Treat this skill as advisory only: review any suggested firewall, registry, or OS hardening step yourself and approve changes one by one.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:37

Finding

Unpinned Third-Party Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37–39
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install deepseekoracle/lygo-pc-lattice-hardening

Technical Analysis

The documented installation command instructs users to execute the package associated with the mutable clawhub@latest tag through npx. If that package is not already available locally, npx may download and execute it, including applicable package lifecycle or command-entry code.

Because latest does not identify an immutable, previously reviewed release, the effective installer code can change after this Skill has been audited. Compromise of the upstream package, publisher account, registry, or release process could therefore expose users to supply-chain code execution.

The bundled scripts/self_check.py does not exhibit malicious behavior; this finding concerns the separate third-party installer command documented in SKILL.md.

Attack Path

1. An attacker compromises the upstream clawhub package, its publisher account, or its release pipeline.
2. The attacker publishes a malicious release and assigns it to the latest distribution tag.
3. A user follows the installation command from SKILL.md.
4. npx resolves clawhub@latest, downloads the attacker-controlled release, and executes its command entry point or associated lifecycle behavior.
5. The malicious code runs with the privileges of the user who invoked the installation command.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the invoking user's account. Depending on that account's permissions and local environment, an attacker could read or modify accessible files, obtain user-level credentials or tokens, install additional payloads, or alter local configuration.

The command does not itself request administrative privileges, so direct impact is ordinarily l ...[truncated 177 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the floating @latest tag with an exact, reviewed package version.
• Document the expected package version and cryptographic integrity value where the package ecosystem supports integrity verification.
• Prefer a lockfile-backed installation workflow that records the complete resolved dependency graph.
• Verify publisher identity, package provenance, signatures, and release attestations before recommending execution.
• Review package lifecycle scripts and transitive dependencies for every version update.
• Perform installation from a non-administrative account and avoid elevated shells.
• Consider separating package acquisition from execution so operators can inspect and verify the artifact before running it.
• Establish a controlled update process in which new versions are audited before the pinned version is changed.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents a Windows security hardening and audit capability for a LYGO PC. The supplied code does not audit or harden a PC, inspect secrets, monitor security state, or interact with Windows-specific settings. Its actual purpose is limited to a packaging/integrity self-check for required project files. This is a materially different primary purpose and resource scope from the declaration, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description uses broad trigger phrases like harden PC, lattice protected, and super charge LYGO machine, which can cause the agent to invoke this skill for loosely related or ordinary user requests. In an automated skill-selection environment, ambiguous activation language increases the chance of overbroad activation, misleading guidance, or unintended execution paths tied to security-sensitive workflows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The 'When to use' section provides vague activation conditions like 'harden PC' and 'pre-flight before USB CLAW or mesh node work' without concrete scope boundaries. In context, this is more dangerous because the skill presents itself as a security/hardening aid, so accidental activation could cause users or orchestration systems to trust advice or linked tooling beyond what is actually validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The install instruction uses npx clawhub@latest, which pulls and executes the latest published package version at install time rather than a reviewed, pinned version. That creates a supply-chain risk: if the package is compromised or changed unexpectedly, users could execute malicious code during installation.

Content

No source excerpt is available for this finding.