LYGO Sovereign Claw Router

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:57 AM UTC
• Version: 1.0.0

Overview

The skill is not clearly malicious, but it routes users into broad external command tooling, runtime credentials, and mutable install/self-check paths with too little scoping.

Review this skill before installing. Use a pinned, trusted installer version, run setup in a low-privilege environment, set LYGO_STACK_ROOT only to a trusted local stack, and provide only least-privilege runtime credentials after confirming how lyra-openclaw handles them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:25

Finding

Mutable Third-Party Package Is Downloaded and Executed During Setup

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned executable dependency
Risk Level: High

Vulnerable Code

bash

npx clawhub@latest install deepseekoracle/lygo-sovereign-claw

Technical Analysis

The documented installation procedure directs npx to download and execute the mutable latest release of the third-party clawhub package. Neither an exact version nor an integrity hash is specified.

Consequently, the code executed by this command can change after the skill has been reviewed. A compromised package publisher, package registry, maintainer account, or newly published malicious release could cause the setup command to execute arbitrary JavaScript lifecycle or command code.

Attack Path

1. An attacker compromises the upstream package, its publisher account, or the package distribution channel.
2. The attacker publishes a malicious version and assigns or causes it to receive the latest tag.
3. A user follows the documented setup instructions.
4. npx retrieves the current latest package from the registry.
5. The downloaded package runs with the privileges and environment of the invoking user.
6. Malicious code can access files, environment variables, credentials, network resources, and processes available to that user.

Impact Assessment

Successful exploitation permits arbitrary code execution with the privileges of the user running the installation command. If setup is run by an administrative or CI/CD account, the impact may include project or system modification, theft of accessible credentials, supply-chain compromise, and access to CI secrets or deployment resources. No malicious upstream package is included in the audited artifact itself; exploitation depends on compromise or unexpected modification of the external dependency.

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Verify the package against a trusted cryptographic integrity digest before execution.
• Commit and enforce an appropriate lockfile where the installation workflow permits it.
• Document the expected package registry and reject alternate or unexpected registries.
• Run installation in a minimally privileged, isolated environment without unnecessary credentials.
• Establish an update process that requires security review before changing the pinned version.
• Consider installing the verified package without executing lifecycle scripts, then explicitly invoke only the reviewed entry point.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/self_check.py:5

Finding

Self-Check Imports Executable Python Modules from an Incorrect External Search Root

Content

View full analysis

Vulnerability Details

File Location: scripts/self_check.py, lines 5-10
Vulnerability Type: Unsafe Python module search-path manipulation
Risk Level: Medium

Vulnerable Code

python

STACK = Path(__file__).resolve().parents[4]
sys.path.insert(0, str(STACK))

from lygo_openclaw.gatekeeper import P0Gatekeeper
from lygo_openclaw.harmony import P5HarmonyNode
from lygo_openclaw.limbs import dispatch

Technical Analysis

The script derives a module search root using a fixed parent depth and inserts it at the beginning of sys.path. In the supplied directory structure, Path(__file__).resolve().parents[4] resolves to the filesystem root /, rather than the project directory or the documented LYGO_STACK_ROOT.

Python executes top-level package code during imports. Therefore, if a package named lygo_openclaw is present at the incorrectly trusted search location, its code may execute before the self-check reaches main(). The imported implementation is outside the audited artifact and is not authenticated or constrained to the intended stack directory.

The fixed-depth calculation also makes the documented self-check nonfunctional when no matching external package is available. Exploitability depends on an attacker being able to place or influence a package in an applicable Python search location. On a conventionally secured host, writing directly beneath / normally requires elevated privileges, which limits practical exploitation through that specific path.

Attack Path

1. An attacker obtains the ability to place a crafted lygo_openclaw package at the derived filesystem search root or otherwise influence a subsequently searched Python package location.
2. The user invokes python scripts/self_check.py.
3. The script prepends the incorrectly calculated external directory to sys.path.
4. Python resolves one or more lygo_openclaw imports to the attacker-controlled package.
5. Attac ...[truncated 789 chars]

Remediation

View remediation

Remediation Suggestions

• Read the intended root from LYGO_STACK_ROOT rather than deriving it through a fixed number of parent directories.
• Resolve the configured path and verify that it exists, is a directory, and contains the expected package structure.
• Reject unexpected roots such as /, /tmp, user-writable shared directories, and paths outside an explicitly trusted location.
• Avoid modifying sys.path globally. Install a pinned, reviewed package into an isolated virtual environment and use normal package imports.
• If path-based loading is unavoidable, validate ownership and permissions and authenticate expected files with cryptographic hashes or signatures.
• Handle missing or invalid configuration explicitly and terminate before attempting imports.
• Run the self-check with least privilege and without unrelated secrets in its environment.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The setup instructions use npx clawhub@latest install ..., which pulls and executes the latest published package version at install time rather than a pinned, reviewed release. In a skill that acts as an agent command router and installs additional tooling, this materially increases supply-chain risk because a compromised or malicious upstream package could execute arbitrary code during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The skill explicitly states that credentials for hybrid browser/social/token operations load at runtime, but it does not provide a clear user-facing warning about what secrets are required, where they are sourced from, how they are stored, or how to avoid exposing them. In the context of a command-routing agent skill connected to browser/social/token operations, this omission raises the likelihood of unsafe secret handling, accidental disclosure, or overbroad credential provisioning.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.