ClawHub
Back to skill

Security audit

LYGO Site Card

Security checks for vulnerabilities and agentic risk

Overview

This skill appears to do what it says: inspect public HTTPS pages or local HTML and optionally save a JSON report when the user explicitly asks.

Install is reasonable for inspecting public web pages you are authorized to request. Use --write only with paths you intend to create or overwrite, and avoid using --file on sensitive private HTML unless you are comfortable with the resulting metadata being printed or saved locally.

SkillSpector

Vulnerability Patterns
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Description-Behavior Mismatch

Medium
Confidence
95% confidence
Finding
The script can write analysis results to an arbitrary local path via --write when --i-consent is supplied, but the skill is described as read-oriented and explicitly emphasizes no live write behavior. In agent environments, this mismatch can expand the tool's effective capabilities and enable unintended local file creation or overwrite if an upstream prompt or workflow passes attacker-influenced output paths.

Intent-Code Divergence

Low
Confidence
87% confidence
Finding
The module docstring and surrounding messaging emphasize non-destructive behavior ('No subprocess' and 'no live Star Chart write') while omitting that the tool can write local files. This creates a capability disclosure gap that can mislead reviewers or orchestration systems into granting the skill broader trust than warranted, increasing the chance of unsafe use.

Static analysis

No suspicious patterns detected.