ClawHub
Back to skill

Security audit

LYGO Sovereign Kernel Seeder

Security checks across malware telemetry and agentic risk

Overview

This skill is a local Python-based registry seeder that is disclosed, consent-gated, and aligned with its stated purpose, with some practical cautions about what files users choose to embed.

Install only if you want a local registry of agent-loadable module manifests. Run seeding only with explicit consent, check the printed registry path and Merkle root, and do not pass files containing secrets, tokens, private paths, or confidential content because small files can be stored directly inside egg JSON as base64.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Lp3

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding
The skill advertises shell execution, environment-variable use, and local file read/write behavior through its documented commands and script interfaces, but it does not declare corresponding permissions. This creates a trust and review gap: an agent or user may treat the skill as low-privilege while it can modify local state, consume sensitive environment data, and invoke interpreter-driven commands.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The schema states the payload contains 'no secrets', but it allows arbitrary `inline_b64` content inside module entries with no structural or size restrictions and no validation that the content is non-sensitive. This creates a mismatch between documented security expectations and enforced constraints, making it easy to embed secrets or other opaque data that downstream systems may trust as safe because the schema suggests otherwise.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.