LYGO Sovereign Kernel Seeder

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

This skill mostly does what it says locally, but its seeding script has under-scoped file-write behavior that can escape the intended registry path.

Review this skill before installing. Use it only with trusted, simple egg IDs, explicit safe seed roots, and non-secret input files; avoid the mutable npx @latest installer path unless you can verify the installer version and provenance.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/seed_kernel.py:220

Finding

Unvalidated Egg Identifier Allows Registry Directory Escape and Arbitrary File Placement

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/seed_kernel.py:252

Finding

Incomplete Rollback Can Destroy Existing Eggs and Leave Registry State Inconsistent

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:44

Finding

Documented Installation Command Executes an Unpinned Mutable npm Package

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The code is a read-only registry listing script. It parses CLI flags, locates a registry file, loads it, and prints egg metadata or JSON output. It does not perform insertion, seeding, self-verification on insert, consent checks, sovereign sealing, or agent kernel installation across a stack. While it references registry and Merkle-root-related metadata, that is only for display. Therefore the declared description materially overstates and misrepresents the actual behavior of this code chunk.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 216)May include surrounding context.

md

| `SKILL.md` | Agent instructions (this file) |

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 21)May include surrounding context.

python

try:
        note = tmp / "module.txt"
        note.write_text("LYGO sovereign seed smoke\n", encoding="utf-8")
        env = os.environ.copy()
        env["LYGO_KERNEL_SEED_CONSENT"] = "yes"
        env["LYGO_SEED_ROOT"] = str(tmp)
        r1 = subprocess.run(

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill advertises and instructs use of Python scripts, local file operations, environment variables, and shell commands, but it does not declare any explicit tool scope such as permissions or allowed-tools. That creates an authorization and review gap: an agent may grant broader filesystem, environment, or shell access than a user expects, increasing the chance of unsafe execution of local scripts or writes to attacker-influenced paths.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Using npx clawhub@latest install ... relies on a moving, unpinned package version at execution time. This introduces a supply-chain risk: if the upstream package is compromised or a breaking/malicious release is published, users may execute attacker-controlled install logic simply by following the documented command.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This is a manifest file, so vague-trigger checks apply. The description uses broad, marketing-style language like "sovereign kernel eggs" and "for agents across the LYGO stack" without stating when the skill should or should not be invoked, making activation scope ambiguous.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The output root is controlled by --root or environment variables, allowing writes outside a fixed application-owned seed store. In agent or automation contexts this becomes an arbitrary file-write surface within the process's permissions, enabling unintended persistence in sensitive directories and making it easier to overwrite or plant files where the caller did not expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The seeder accepts arbitrary caller-supplied file paths, reads their contents, and may embed full file data inline as base64 in the generated egg. In an agent setting, this creates a clear local file exfiltration/over-collection primitive: a user or upstream workflow can cause sensitive local files to be packaged into persistent artifacts, which is broader than a narrowly scoped kernel-seeding function.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 24)May include surrounding context.

python

env = os.environ.copy()
        env["LYGO_KERNEL_SEED_CONSENT"] = "yes"
        env["LYGO_SEED_ROOT"] = str(tmp)
        r1 = subprocess.run(
            [
                sys.executable,
                str(HERE / "seed_kernel.py"),

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/smoke_test.py (reported line 51)May include surrounding context.

python

print(r1.stderr, file=sys.stderr)
            print("SMOKE_FAIL seed", r1.returncode)
            return 1
        r2 = subprocess.run(
            [sys.executable, str(HERE / "verify_seed.py"), "--root", str(tmp), "--json"],
            capture_output=True,
            text=True,

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

In --manifest mode, the script creates eggs/<egg_id>.seed.txt via write_text, which is a file write affecting the user's filesystem. Although the script requires consent globally, this specific write is not accompanied by a user-facing disclosure at the point of action or a comment/docstring explaining that a placeholder file will be created.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script writes persistent JSON files to eggs/<egg_id>.egg.json and registry.json using atomic_write_json, which changes local state. The code has a consent check, but it does not clearly warn the user before the write about which files will be created or modified; the paths are only shown after success.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.