LYGO SMART DISK AGENT

• Outcome: Pass
• Latest audit: Jul 19, 2026 · 7:42 PM UTC
• Version: 1.1.0

Overview

This is a disclosed local AI portal skill with proportionate localhost, token, browser, and local metadata behavior, though some older design docs still describe a no-auth model.

Install only if you are comfortable running a localhost AI portal that opens your browser and talks to local Ollama. Keep auth.required enabled, avoid LAN binding unless you understand the risk, and treat the printed data/.sda_local_token value like a local bearer secret.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill advertises or implies capabilities such as file access, shell execution, environment access, and network use, but does not declare permissions in the skill manifest. This creates a transparency and policy-enforcement gap: users and tooling cannot accurately assess or constrain what the skill may do before installation, increasing the risk of unexpected privileged actions.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The open_url_limb can launch the host browser to external sites, which creates a host-side action surface not clearly necessary for a disk/portal agent. Even with prefix allowlisting, this can be abused for unwanted navigation, user tracking, phishing through trusted-looking allowed domains, or opening attacker-controlled subpaths if any allowed site is later compromised; invoking a local browser is a meaningful side effect beyond normal agent status operations.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The build spec explicitly disables authentication on loopback even though the skill metadata says the localhost portal uses a local operator token. Loopback-only exposure reduces but does not remove risk, because any local process, malware, browser-assisted localhost access path, or another user on a shared host/session may be able to invoke the agent without authorization.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The server prints the active local operator token directly to stdout and also constructs a browser URL containing that token as a query parameter. Even though the design is intended for localhost use, console output can be captured by terminal logs, shell history tooling, process supervisors, screen sharing, or local multi-user environments, turning the token into a reusable bearer credential.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly promotes a local portal with 'no password gate' and 'open loopback browser UI one-shot' but does not pair that design with prominent security caveats or compensating controls. Even if bound to 127.0.0.1, unauthenticated local control surfaces are risky because other local processes, browser-based attacks, malicious extensions, or port-forwarding/misconfiguration can drive the interface without user approval.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: Listing 'Boot one-shot without password' as a success criterion normalizes insecure startup behavior without any adjacent warning, exception scope, or mention of safeguards. In context, this reinforces a product goal of removing authentication from a control plane, which can lead implementers to deprioritize basic local-access protections.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly states a local agent control plane with 'No password' and loopback-only binding as the authentication model. While loopback reduces exposure, it does not eliminate risk from local malware, malicious browser pages exploiting localhost services, cross-origin requests to permissive local endpoints, or other users/processes on the same machine; documenting this without clear security caveats normalizes an unsafe default.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The markdown advertises a browser-opening capability ('browser-open' / 'open default browser to URL') without warning about side effects such as launching untrusted pages, triggering custom URI handlers, or enabling phishing and localhost pivoting workflows. In an agent/tooling context, even a seemingly simple open-URL action can become security-relevant if invoked with attacker-controlled input.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The spec calls for an HTTP server with no authentication on loopback and does not warn operators about the security consequences. In the context of an agent with health, chat, and limb control surfaces, unauthenticated localhost services can be abused by local malware, untrusted co-resident software, or cross-origin localhost interaction patterns to issue commands or read sensitive data.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.