LYGO Skill Gate

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:54 AM UTC
• Version: 1.0.0

Overview

This is a local skill-package scanner whose code and documentation align with its stated purpose, with a documented but unpinned install command users should treat carefully.

Before installing, review or pin the clawhub installer version instead of relying on @latest. When using the scanner, only point it at directories you intend to inspect, and avoid sharing generated reports publicly because findings may include snippets of secret-looking text from the scanned package.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:59

Finding

Unpinned Package Execution in Installation Instructions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:59
Vulnerability Type: Unpinned third-party package execution and supply-chain exposure
Risk Level: Medium

Vulnerable Code

bash

npx clawhub@latest install deepseekoracle/lygo-skill-gate

Technical Analysis

The documented installation command invokes npx with the mutable clawhub@latest package reference. If the package is not already available locally, npx may retrieve it from the configured npm registry and execute its entry point. The latest tag can be reassigned to a different release after this Skill has been audited, so the code ultimately executed by users is not fixed to the reviewed project contents.

The scanner itself does not use network APIs, launch subprocesses, retrieve remote payloads, or execute scanned code. The risk is confined to the separately documented installation workflow and requires a user or automation system to run the command. Nevertheless, executing a mutable remote dependency grants that dependency privileges beyond those needed by the local, standard-library-only scanner.

Attack Path

1. An attacker compromises the publisher account, npm package, registry delivery path, or a dependency used by a future clawhub release.
2. The attacker publishes a malicious version and causes the mutable latest tag to resolve to it.
3. A user follows the installation command in SKILL.md.
4. npx downloads and executes the attacker-controlled package or its installation lifecycle code.
5. The malicious code runs with the operating-system privileges and accessible environment of the user invoking the command.

Impact Assessment

Successful exploitation could permit arbitrary code execution with the installing user's privileges. Depending on the local environment, this could expose files, environment variables, credentials available to that account, and writable project or user directories. It could also allow additional payload retrieval or persi ...[truncated 283 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the mutable @latest reference with an explicitly reviewed version:

   bash

   npx clawhub@<reviewed-version> install deepseekoracle/lygo-skill-gate
   

2. Publish and document the expected package digest or registry integrity value, and require verification before execution.
3. Recommend a two-step installation process that downloads or installs the package without immediately executing it, allowing operators to inspect and verify the resolved artifact first.
4. Use a lockfile or equivalent dependency-resolution record where the surrounding installation system supports it.
5. Run the installer in a restricted environment with minimal filesystem access, no unnecessary credentials, and no elevated operating-system privileges.
6. Update the documentation to state that the installation command executes third-party registry code and is outside the scanner's local-only runtime permission model.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/self_check.py (reported line 30)May include surrounding context.

python

(root / "scripts").mkdir()
        (root / "scripts" / "bad.py").write_text(
            "import subprocess\nimport urllib.request\n"
            "subprocess.run(['echo','hi'], shell=True)\n"
            "urllib.request.urlopen('https://example.com')\n"
            "api_key = 'sk-proj-ABCDEFGHIJKLMNOPQRSTUVWX'\n",
            encoding="utf-8",

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The install command uses 'npx clawhub@latest', which is not pinned to a specific version. If the upstream package is compromised or a breaking/malicious release is published, users following the documentation could execute unreviewed code during installation, creating a supply-chain risk.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · LICENSE (reported line 12)May include surrounding context.

text

permit persons to whom the Software is furnished to do so.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A
PARTICULAR PURPOSE AND NONINFRINGEMENT.

ClawHub distribution uses MIT-0 as required by the registry.