LYGO Sovereign Workflow Orchestrator

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.0.0

Overview

The skill is a disclosed local workflow orchestrator with no evidence of hidden or malicious behavior, though its install and self-check steps rely on mutable or external code that users should review.

Install and run this only in a development environment you control. Pin or review `clawhub` and `sandcastle-ai` before installing, keep dry-run mode for initial use, validate untrusted workflow YAML before running it, avoid committing workflow files that contain secrets, and require explicit consent for sandbox, kernel, or publishing actions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:20

Finding

Mutable and Unpinned Third-Party Dependencies Can Execute Unreviewed Code

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20–31
Vulnerability Type: Supply-chain risk from mutable and unpinned dependencies
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install deepseekoracle/lygo-sandcastle
export LYGO_STACK_ROOT=/absolute/path/to/lygo-protocol-stack
python tools/install_lygo_sandcastle.py

text

Optional: `pip install sandcastle-ai` + `LYGO_SANDCASTLE_USE_UPSTREAM=yes` (user trust required).

Technical Analysis

The documented setup executes clawhub@latest, which is a mutable package reference. The code retrieved when a user runs this command may therefore differ from the version that existed when the skill was reviewed. The package is downloaded and executed without a pinned version, integrity hash, lockfile, or other reproducibility control.

The optional sandcastle-ai dependency is also installed without an exact version or integrity verification. Python package installation can execute package build hooks, and the installed package may later execute when imported or enabled. Although the documentation states that user trust is required, this warning does not technically prevent substitution of a compromised or unexpectedly changed release.

Attack Path

1. An attacker compromises the relevant package publisher, registry account, distribution channel, or upstream release process.
2. The attacker publishes a malicious package under the mutable latest release or a version satisfying the unpinned installation command.
3. A user follows the documented setup instructions.
4. npx downloads and executes the changed package, or pip installs a malicious distribution and runs applicable build hooks.
5. The malicious code executes with the privileges and environment of the user running the installation.

Impact Assessment

Successful exploitation permits arbitrary code execution under the installing user's account. The resu ...[truncated 477 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an explicitly reviewed package version.
• Pin sandcastle-ai to an exact version rather than allowing the package manager to select a mutable release.
• Use lockfiles and registry-supported integrity hashes to make installations reproducible.
• Verify package signatures, checksums, publisher identity, and release provenance before execution.
• Prefer downloading and inspecting packages before running installers rather than using npx for immediate retrieval and execution.
• Run installation in a restricted environment without production credentials, sensitive environment variables, or unnecessary filesystem access.
• Document the trusted registry and the exact reviewed versions in SKILL.md.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/self_check.py:9

Finding

Self-Check Imports Executable Python Modules from Outside the Audited Project

Content

View full analysis

Vulnerability Details

File Location: scripts/self_check.py, lines 9–13
Vulnerability Type: Unsafe Python import-path manipulation
Risk Level: Low

Vulnerable Code

python

STACK = Path(__file__).resolve().parents[4]
sys.path.insert(0, str(STACK))

from lygo_sandcastle.gatekeeper import P0Gatekeeper  # noqa: E402
from lygo_sandcastle.harmony import P5HarmonyNode  # noqa: E402

Technical Analysis

The script derives an import root by ascending exactly four parent directories from its own resolved path and then places that location at the beginning of sys.path. In the supplied directory layout, the script resides at artifact/scripts/self_check.py; ascending four parents reaches the filesystem root rather than a directory contained in the audited project.

Python searches the prepended location before normal package directories. Consequently, running the documented self-check can execute lygo_sandcastle package initialization and the imported gatekeeper and harmony modules from an external, unaudited location. The script does not validate that the selected directory is the intended stack root, does not ensure that it remains within an approved directory, and does not use the documented LYGO_STACK_ROOT setting.

Importing a Python package executes its __init__.py and module-level statements. A matching package at the selected location can therefore execute code before the self-check performs its validation.

Attack Path

1. An attacker or untrusted installation process places a lygo_sandcastle package at the path selected by parents[4].
2. The user runs the documented command: python scripts/self_check.py.
3. The script prepends the externally derived directory to sys.path.
4. Python resolves lygo_sandcastle.gatekeeper and lygo_sandcastle.harmony from that location.
5. Package initialization and module-level attacker-controlled code execute with the privileges of the ...[truncated 825 chars]

Remediation

View remediation

Remediation Suggestions

• Remove fixed-depth ancestor traversal and avoid prepending broad external directories to sys.path.
• Package the required modules as declared, version-pinned dependencies and import them through the standard package environment.
• If an external stack is required, resolve it from LYGO_STACK_ROOT, require an absolute canonical path, and verify that it points to the expected installation.
• Reject filesystem root, world-writable directories, and paths outside an explicit allowlist.
• Verify ownership and permissions of the selected package directory before importing from it.
• Consider executing the self-check in an isolated virtual environment containing only reviewed dependencies.
• Add tests covering different installation depths so path resolution cannot silently escape the intended project root.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill advertises operational commands and references local file-based workflow execution, but it does not declare an explicit tool scope such as permissions or allowed-tools. In an agent ecosystem, missing scope boundaries can cause the runtime or downstream operator to grant broader file access than intended, increasing the risk of unauthorized reads from the local environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The setup instruction uses npx clawhub@latest install ..., which pulls a mutable package version at execution time. This creates a supply-chain risk: if the package or one of its dependencies is compromised later, users installing the skill may execute attacker-controlled code without any change to the skill file itself.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · references/SECURITY.md (reported line 4)May include surrounding context.

md

# SECURITY — LYGO Sandcastle

- Agents must **not** `git push` or ClawHub publish without explicit user consent.
- **Docker/Podman sandboxes** run arbitrary code — only enable with user-approved workflows.
- Do not enable `LYGO_SANDCASTLE_USE_UPSTREAM` on untrusted machines without reviewing upstream `sandcastle-ai`.
- Workflow YAML may contain **prompts with secrets** — never commit sensitive YAML to public repos.
- Kernel egg plant requires `--i-consent` on `workflow_orchestrator_planter.py`.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.