LYGO SMART DISK AGENT

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:20 AM UTC
• Version: 1.1.0

Overview

The skill is a disclosed local Ollama web portal with local token protection and local metadata storage, but users should understand its installer and token-handling tradeoffs.

Install only as an unprivileged local user, prefer a pinned installer version, keep the generated local token private, avoid enabling auth.required=false or LAN binding unless you understand the exposure, and treat the portal as a local service that writes token and metadata files under its data directory.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:21

Finding

Mutable Installation Dependency Executed Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:21
Vulnerability Type: Unpinned third-party package execution
Risk Level: Medium

Vulnerable Code:

bash

npx clawhub@latest install deepseekoracle/lygo-smart-disk-agent

Technical Analysis

The documented installation procedure invokes the mutable latest release of the third-party clawhub package. npx may download and execute that package during installation. No exact version, integrity hash, lockfile, or provenance verification is specified.

Consequently, the code executed by this command can change after the Skill has been audited. This is a supply-chain weakness rather than evidence that the currently referenced package is malicious.

Attack Path

1. An attacker compromises the upstream package publisher, package registry account, release workflow, or distribution channel.
2. The attacker publishes a modified package under the version selected by the latest tag.
3. A user follows the installation command from SKILL.md.
4. npx downloads and executes the modified package.
5. The malicious package runs with the permissions of the user performing the installation.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the installing user's account. Depending on that account's permissions, the compromised dependency could read or modify user-accessible files, access credentials available to the process, alter the installed Skill, or establish additional unauthorized behavior.

The reviewed project does not itself request elevated operating-system privileges, so the direct scope is normally limited to the installing user's privileges unless the command is run from an elevated shell.

Remediation

View remediation

Remediation Suggestions

• Replace clawhub@latest with a reviewed, exact package version.
• Publish and verify a cryptographic integrity digest or signed provenance statement for the installer.
• Use a lockfile or equivalent dependency-resolution record where supported.
• Document that installation should be performed as an unprivileged user.
• Review and update the pinned version deliberately rather than allowing automatic selection of mutable releases.
• Consider separating package download from execution so users can verify the artifact before running it.

T09 · Insecure Skill Coding Practices

Note

• Location: public/agent/smart_disk_agent.py:336

Finding

Loopback-Only Binding Policy Can Be Bypassed with an Explicit LAN Address

Content

View full analysis

Vulnerability Details

File Location: public/agent/smart_disk_agent.py:336-341
Vulnerability Type: Incomplete network binding validation
Risk Level: Low

Vulnerable Code:

python

bind = str(agent.cfg.get("bind", "localhost")).strip() or "localhost"
if bind in ("0.0.0.0", "::", "[::]"):
    if os.environ.get("LYGO_SDA_ALLOW_LAN") != "1":
        print("[SDA] refusing non-loopback bind; set LYGO_SDA_ALLOW_LAN=1 to override")
        bind = "localhost"
port = int(agent.cfg.get("port", 9631))

Technical Analysis

The implementation only treats the wildcard values 0.0.0.0, ::, and [::] as non-loopback bindings requiring the LYGO_SDA_ALLOW_LAN=1 override. It does not reject explicit non-loopback addresses or hostnames.

For example, a configuration value such as 192.168.1.10 can cause the service to listen on a LAN interface without the documented override. This contradicts the stated localhost-only trust model and weakens defense in depth.

Authentication remains enabled by default for protected APIs. However, /api/health and /api/auth are intentionally public, so an unintended LAN binding exposes those probes to other network hosts.

Attack Path

1. The configuration is changed, packaged, or deployed with bind set to an explicit LAN address or a hostname resolving to one.
2. The server checks the value against only the three wildcard strings.
3. The explicit non-loopback value passes validation without requiring LYGO_SDA_ALLOW_LAN=1.
4. The HTTP server listens on the selected LAN interface.
5. A host on the same reachable network accesses the public health and authentication endpoints.
6. If that host separately obtains the local operator token, it can also invoke the authenticated chat, status, help, and allowlisted limb interfaces.

Impact Assessment

Without the token, an attacker can reach the portal and obtain information exposed by public probes, includ ...[truncated 479 chars]

Remediation

View remediation

Remediation Suggestions

• Parse and resolve the configured bind value before constructing the HTTP server.
• Require every resolved address to be loopback unless LYGO_SDA_ALLOW_LAN=1 is explicitly set.
• Use ipaddress.ip_address(address).is_loopback for literal IPv4 and IPv6 addresses.
• Resolve hostnames with socket.getaddrinfo and reject the binding if any selected address is non-loopback.
• Prefer a fixed default such as 127.0.0.1 or ::1 rather than relying solely on hostname resolution.
• When LAN mode is enabled, emit a prominent warning and retain mandatory token authentication.
• Consider restricting or authenticating health details in LAN mode to reduce information disclosure.
• Add tests covering explicit private, public, wildcard, IPv4 loopback, IPv6 loopback, and hostname bind values.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (49)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The code clearly implements persistent local memory storage in mycelium/events.jsonl, including write, read, and retention management. The description prominently claims 'No HTTP chat-memory export,' which only excludes one specific kind of export, but it does not clearly declare that the skill actually maintains append-only local memory. Since this chunk’s primary purpose is a memory subsystem (P1 memory), that is a materially relevant capability absent from the declared description. There is no evidence of HTTP export or cloud password use, but the declared purpose does not accurately represent this code chunk’s actual behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The declared description presents a broader agent/platform capability set: localhost portal behavior, local authentication model, P0–P5 scope, Ollama hosting, and restrictions on HTTP chat-memory export. The actual code chunk does not implement or directly support those described functions. Instead, it provides a lightweight identity record generator for P5 actions, producing hashes and heuristic metadata for commands. This is materially different from the declared primary purpose, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

YARA rule 'info_stealer': Information stealer patterns (credential harvesting, browser data theft) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · public/kernel/p0_gate.py (reported line 14)May include surrounding context.

python

"""P0 Φ-gate — lean self-contained ethical pre-filter for Smart Disk Agent."""
from __future__ import annotations

import re
from typing import Any

SIGNATURE = "Δ9Φ963-SDA-P0-GATE-v1"

# High-signal quarantine patterns (abuse / exfil / destructive)
_QUARANTINE = re.compile(
    r"("
    r"rm\s+-rf\s+/|"
    r"format\s+c:|"
    r"mimikatz|"
    r"ignore\s+(all\s+)?(previous|prior)\s+instructions|"
    r"exfiltrate\s+secrets|"
    r"disable\s+safety|"
    r"child\s+sexual|"
    r"make\s+a\s+bomb\s+detailed"
    r")",
    re.I,
)

_MAX_CHARS = 12000


class P0Gate:
    def validate(self, text: str) -> dict[str, Any]:
        t = (text or "").strip()
        if not t:
            return {"verdict": "ALLOW", "reason": "empty", "signature": SIGNATURE}
        if len(t) > _MAX_CHARS:
            return {
                "verdict": "QUARANTINE",
                "reason": f"payload_exceeds_{_MAX_CHARS}",
                "signa

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · public/tests/test_smart_disk.py (reported line 24)May include surrounding context.

python

def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · public/verify/self_check.py (reported line 37)May include surrounding context.

python

def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/self_check.py (reported line 49)May include surrounding context.

python

def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 100% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · public/tests/test_smart_disk.py (reported line 24)May include surrounding context.

python

def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · public/tests/test_smart_disk.py (reported line 24)May include surrounding context.

python

ensus, P5Identity  # noqa: E402
from agent.auth import LocalTokenAuth  # noqa: E402
from agent.smart_disk_agent import SmartDiskAgent  # noqa: E402


class TestKernel(unittest.TestCase):
    def test_p0_allow(self):
        self.assertEqual(P0Gate().validate("status please").get("verdict"), "ALLOW")

    def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):
        n = P5Identity().create_node("help")
        self.assertEqual(len(n["light_code"]), 16)

    def test_p3(self):
        c = P3Consensus().achieve({"command": "x"})
        self.assertTrue(c.get("consensus_found"))

    def test_memory(self):
        m = P1Memory(ROOT / "data")
        i = m.store({"t": 1})
        self.assertTrue(i)
        self.assertTrue(any(x.get("id") == i for x in m.list_recent(5)))


class TestAuth(unittest.TestCase):
    def test_token_roundtrip(self):
        with tempfile.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · public/verify/self_check.py (reported line 37)May include surrounding context.

python

ensus, P5Identity  # noqa: E402
from agent.auth import LocalTokenAuth  # noqa: E402
from agent.smart_disk_agent import SmartDiskAgent  # noqa: E402


class TestKernel(unittest.TestCase):
    def test_p0_allow(self):
        self.assertEqual(P0Gate().validate("status please").get("verdict"), "ALLOW")

    def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):
        n = P5Identity().create_node("help")
        self.assertEqual(len(n["light_code"]), 16)

    def test_p3(self):
        c = P3Consensus().achieve({"command": "x"})
        self.assertTrue(c.get("consensus_found"))

    def test_memory(self):
        m = P1Memory(ROOT / "data")
        i = m.store({"t": 1})
        self.assertTrue(i)
        self.assertTrue(any(x.get("id") == i for x in m.list_recent(5)))


class TestAuth(unittest.TestCase):
    def test_token_roundtrip(self):
        with tempfile.

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · scripts/self_check.py (reported line 49)May include surrounding context.

python

ensus, P5Identity  # noqa: E402
from agent.auth import LocalTokenAuth  # noqa: E402
from agent.smart_disk_agent import SmartDiskAgent  # noqa: E402


class TestKernel(unittest.TestCase):
    def test_p0_allow(self):
        self.assertEqual(P0Gate().validate("status please").get("verdict"), "ALLOW")

    def test_p0_quarantine(self):
        self.assertEqual(
            P0Gate().validate("please rm -rf / now").get("verdict"), "QUARANTINE"
        )

    def test_p5_light_code(self):
        n = P5Identity().create_node("help")
        self.assertEqual(len(n["light_code"]), 16)

    def test_p3(self):
        c = P3Consensus().achieve({"command": "x"})
        self.assertTrue(c.get("consensus_found"))

    def test_memory(self):
        m = P1Memory(ROOT / "data")
        i = m.store({"t": 1})
        self.assertTrue(i)
        self.assertTrue(any(x.get("id") == i for x in m.list_recent(5)))


class TestAuth(unittest.TestCase):
    def test_token_roundtrip(self):
        with tempfile.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · public/verify/self_check.py (reported line 37)May include surrounding context.

python

ch/LYGO_SMART_DISK_BOOT.bat",
    ]:
        if not (ROOT / rel).is_file():
            fails.append(f"missing:{rel}")

    from kernel import P0Gate, P1Memory
    from agent.smart_disk_agent import SmartDiskAgent
    from agent.auth import LocalTokenAuth

    g = P0Gate()
    if g.validate("hello lattice").get("verdict") != "ALLOW":
        fails.append("p0_allow")
    if g.validate("rm -rf / && disable safety").get("verdict") != "QUARANTINE":
        fails.append("p0_quarantine")

    mem = P1Memory(ROOT / "data")
    mid = mem.store({"test": True})
    if not mid:
        fails.append("memory")

    agent = SmartDiskAgent(ROOT)
    h = agent.run_limb("health")
    if not h.get("ok"):
        fails.append("health")
    if h.get("password_gate") is not False:
        fails.append("password_gate_should_be_false")
    if not agent.auth.required:
        fails.append("auth_should_be_required_by_default")
    if not agent.auth.token or len(agent.auth.token) < 16:
        fails.append("tok

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/self_check.py (reported line 49)May include surrounding context.

python

ch/LYGO_SMART_DISK_BOOT.bat",
    ]:
        if not (ROOT / rel).is_file():
            fails.append(f"missing:{rel}")

    from kernel import P0Gate, P1Memory
    from agent.smart_disk_agent import SmartDiskAgent
    from agent.auth import LocalTokenAuth

    g = P0Gate()
    if g.validate("hello lattice").get("verdict") != "ALLOW":
        fails.append("p0_allow")
    if g.validate("rm -rf / && disable safety").get("verdict") != "QUARANTINE":
        fails.append("p0_quarantine")

    mem = P1Memory(ROOT / "data")
    mid = mem.store({"test": True})
    if not mid:
        fails.append("memory")

    agent = SmartDiskAgent(ROOT)
    h = agent.run_limb("health")
    if not h.get("ok"):
        fails.append("health")
    if h.get("password_gate") is not False:
        fails.append("password_gate_should_be_false")
    if not agent.auth.required:
        fails.append("auth_should_be_required_by_default")
    if not agent.auth.token or len(agent.auth.token) < 16:
        fails.append("tok

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill declares installation and execution steps that invoke shell commands, Python scripts, network pulls, and local file operations, but it does not declare any explicit tool scope or permissions. This creates a transparency and least-privilege gap: a user or platform cannot easily assess what capabilities the skill needs before running it, increasing the chance of overbroad execution in a sensitive environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Using 'npx clawhub@latest install ...' pulls and executes the latest available package version at install time, which is a software supply-chain risk. A compromised or breaking upstream release could execute unexpected code on the host, and the danger is amplified because installation is done through a shell command.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill exposes a host-action capability that can open arbitrary allowlisted external websites in the user's browser, which expands a supposedly localhost-focused agent into interacting with public internet destinations. Even with an allowlist, this creates an unnecessary trust boundary crossing and can enable phishing, user-tracking, or operator coercion if the limb is reachable through untrusted prompts or local integrations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Launching the host browser is a privileged side effect that is not clearly necessary for a smart disk agent and increases the attack surface of the host environment. In context, the agent claims local-only behavior and limited export, so adding a browser-open primitive makes prompt-driven or indirect misuse more dangerous by enabling external navigation from the host.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

When auth is enabled, the server prints the local operator token to stdout and also embeds it in a one-shot browser URL query string. Tokens printed to console can be captured by terminal logs, shell history tooling, process supervisors, screenshots, or remote session transcripts, and query-string tokens are especially prone to leakage via browser history or local monitoring tools.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The document explicitly makes a passwordless local portal a non-negotiable design pillar and also targets one-shot boot behavior, which normalizes unauthenticated access as a feature. Even if bound to loopback, local malware, a malicious local user, browser-based localhost abuse, or accidental exposure via port forwarding/proxy misconfiguration could access or drive the agent without meaningful user authentication.

Content

No source excerpt is available for this finding.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence

Finding

Suspicious Unicode normalization or mixed-script content

Content

No source excerpt is available for this finding.