Security audit

LYGO Second Brain

Security checks for vulnerabilities and agentic risk

Overview

The skill appears intended as a local vault/wiki helper, but it relies on mutable package execution and external Python code outside the reviewed artifact.

Install only in a constrained environment after verifying the ClawHub package version and the lygo-protocol-stack checkout you intend to use. Treat LYGO_VAULT_ROOT as sensitive, avoid storing secrets in notes, and do not allow push, publish, remote inference, or permaweb actions unless you explicitly requested them.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Error

Location: SKILL.md:30
Finding: Unpinned External Package Download and Execution
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: scripts/self_check.py:9
Finding: Self-Check Imports and Executes Unaudited Code Outside the Skill
Content: View full analysis
int: assert slugify("Hello, LYGO!") == "hello-lygo" with tempfile.TemporaryDirectory() as td: p = Path(td) / "t.txt" p.write_text("lygo", encoding="utf-8") h = sha256_of_file(p) assert len(h) == 64 note = Path(td) / "n.md" write_note(note, {"title": "T", "tags": ["a", "b"]}, "body") fm, body = read_note(note) assert fm.get("title") == "T" assert body == "body" assert git_commit(Path(td), "test") in ("ok", "nothing-to-commit", "not-a-git-repo") ``` ### Technical Analysis The self-check derives a stack location by traversing four parent directories from its own path, constructs an external scripts directory, and inserts that directory at the beginning of `sys.path`. It then imports `vault_lib`, which is not included anywhere in the audited project. Placing the directory at index zero gives modules in that location priority during import resolution. Python also executes module-level statements as soon as the import occurs. Consequently, merely running the documented self-check can execute arbitrary code contained in an externally supplied or replaced `vault_lib.py`, before `main()` begins. The path is based on the surrounding filesystem layout rather than a verified package dependency or trusted configured root. In the supplied directory layout, traversing four parents resolves outside the artifact. The imported implementation therefore falls outside the ...[truncated 1396 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill advertises commands that read environment variables and perform local file-writing actions, but it does not declare an explicit tool scope such as permissions or allowed-tools. That omission increases the chance an agent executes the skill with broader-than-necessary access, enabling unintended modification of local vault data or use of sensitive environment configuration.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
- Cloud-only Kimi/Claude as primary (optional fallback only) - Autonomous overnight `/dream` v1 (not shipped — build after ingest+index stable) - Auto `git push`, ClawHub publish, or kernel egg plant without consent ## Setup

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: Using 'npx clawhub@latest install' pulls and executes the newest available package version at runtime, which is a classic supply-chain risk. If the package or dependency chain is compromised, an agent following these setup instructions could execute attacker-controlled code on the host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The maintainer publish command again uses 'npx clawhub@latest', creating the same unpinned remote execution path during publication workflows. Because publishing often runs in privileged developer environments, compromise here could affect credentials, repositories, or released artifacts.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.