LYGO pxpipe-LYGO

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 1.0.1

Overview

The skill is open about its compression/proxy purpose, but its setup asks users to run mutable, unverified external code that can access local files and API keys.

Review this before installing. Only use it with a trusted, pinned lygo-protocol-stack checkout, avoid @latest installs where possible, run it in an isolated environment, and provide API keys only after confirming the proxy code you will execute.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:29

Finding

Unpinned and Unverified Executable Dependencies

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-43; scripts/self_check.py:20-29
Vulnerability Type: Supply-chain execution through mutable and unverified dependencies
Risk Level: High

Evidence

SKILL.md:29-43:

bash

npx clawhub@latest install deepseekoracle/lygo-pxpipe-lygo
export LYGO_STACK_ROOT=/absolute/path/to/lygo-protocol-stack
pip install -r "$LYGO_STACK_ROOT/requirements-pxpipe.txt"

bash

cd "$LYGO_STACK_ROOT"
python tools/pxpipe_lygo_for_agent.py --shrink-file path/to/huge.txt --target grok
python tools/pxpipe_lygo_for_agent.py --file path/to/huge.txt --target anthropic --png .pxpipe_ctx.png

bash

python tools/run_pxpipe_lygo_proxy.py

scripts/self_check.py:20-29:

python

if STACK.is_dir():
    req_stack = [
        STACK / "pxpipe_lygo" / "compressor.py",
        STACK / "tools" / "pxpipe_lygo_for_agent.py",
        STACK / "docs" / "BIOPHASE7_PXPIPE_LYGO.md",
    ]
    miss_stack = [str(p) for p in req_stack if not p.exists()]
    if miss_stack:
        print("WARN LYGO_STACK_ROOT set but missing", miss_stack)

Technical Analysis

The documented installation process invokes the mutable npm tag @latest and installs Python requirements from a user-selected external stack without requiring pinned versions, package hashes, a signed revision, or verification of the stack's origin. The documented workflow then directly executes Python programs from that external directory.

The bundled self-check only confirms that expected paths exist. It does not verify file type, ownership, permissions, cryptographic hashes, repository provenance, signed commits, package integrity, or whether symbolic links redirect those paths elsewhere. Consequently, a substituted or compromised LYGO_STACK_ROOT can satisfy the check while containing attacker-controlled executable code. The signature string present in Skill metadata is not validated crypto ...[truncated 1420 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace mutable package tags such as @latest with an explicitly reviewed version and enforce lockfile integrity.
2. Pin every Python dependency to an exact version and require cryptographic hashes, for example through a hash-locked requirements file using pip --require-hashes.
3. Pin the external stack to a specific reviewed commit or immutable release artifact.
4. Verify signed releases or commits and compare trusted cryptographic checksums before executing stack scripts.
5. Extend self_check.py to validate approved hashes for executable files rather than checking only path existence.
6. Resolve paths with Path.resolve(), ensure each required file remains within the trusted stack root, reject symbolic links where appropriate, and validate ownership and unsafe write permissions.
7. Install and execute dependencies in an isolated environment with minimum filesystem and network privileges.
8. Keep API credentials scoped to the minimum required permissions and provide them only to a verified proxy process.
9. Fail closed when provenance or integrity checks cannot be completed rather than emitting a warning and continuing successfully.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill declares operational capabilities in freeform metadata, including filesystem read/write, subprocess execution, localhost network access, and reliance on environment variables, but does not define an explicit tool permission scope such as 'permissions' or 'allowed-tools'. This can lead an agent platform or reviewer to underestimate the skill's effective privileges, increasing the chance of overbroad execution, unsafe environment access, or unintended invocation of local tooling.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using 'npx clawhub@latest install ...' pulls and executes the most recent package version at install time, which creates a supply-chain risk if the package is compromised, a malicious release is published, or behavior changes unexpectedly. Because this command is intended for installation and may run with developer credentials and network access, exploitation could lead to arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.