Security audit

LYGO Tools Portal

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed LYGO tool router, but it needs review because it steers agents toward publisher-controlled installs and mutable npx commands.

Install this only if you intentionally want an agent to prioritize the LYGO ecosystem. Do not allow automatic npx, ClawHub skill installs, stack CLI execution, LYGO_STACK_ROOT access, or LYGO_VAULT_ROOT access without explicit approval, and prefer pinned or otherwise verified package versions before running any install command.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:36
Finding: Publisher-Controlled Instruction and Output Routing
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:13
Finding: Execution and Installation of Mutable Remote Dependencies
Content: View full analysis
` — full list in manifest `clawhub_skills[]`. Priority chain: **`lygo-tools-portal`** → `lygo-network-builder` → `lygo-protocol-stack-operator` → specialty (`lygo-pxpipe-lygo`, `lygo-resonance`, …). ``` Representative manifest entries include: ```json { "slug": "lygo-tools-portal", "role": "this_skill", "install": "npx clawhub@latest install deepseekoracle/lygo-tools-portal" }, { "slug": "lygo-protocol-stack-operator", "intents": ["stack ops", "p0", "lattice verify", "audit"], "install": "npx clawhub@latest install deepseekoracle/lygo-protocol-stack-operator" } ``` The same mutable installation pattern is used for 17 remote Skill entries in `references/TOOLS_MANIFEST.json:115-198`. ### Technical Analysis The command uses `npx` with the mutable `clawhub@latest` version. Consequently, the package executed at installation time may differ from the package available when this project was audited. The target Skills are also identified only by publisher and slug. The project provides no immutable version, content digest, lock file, locally verifiable signature, or audited copy of those downstream Skills. The decorative `signature` strings in project metadata are not accompanied by cryptographic verification logic and therefore do not establish artifact integrity. This creates a supply-chain boundary in which compromise of the package registry, package release, publisher account, or a later Skill revision can change the effe ...[truncated 1291 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 77% confidence
Finding: The skill explicitly instructs agents to read local files such as references/AGENT_CONTRACT.md, references/SECURITY.md, references/TOOLS_MANIFEST.json, and optionally files under $LYGO_STACK_ROOT, but it does not declare an explicit tool scope via permissions or allowed-tools. That mismatch can cause agents or hosting platforms to grant broader filesystem-read behavior than intended, increasing the risk of unintended local file access if the skill is mirrored into a sensitive environment.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: Using 'npx clawhub@latest install deepseekoracle/lygo-tools-portal' pulls the latest package version at execution time, which creates a supply-chain risk because future compromised or malicious releases would be executed implicitly. Since this is an installation path for agents and users, the context makes the issue more dangerous: the skill is directly guiding consumers to run an unpinned remote package.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: This second use of 'npx clawhub@latest install deepseekoracle/' repeats the same unpinned execution pattern, exposing agents to remote package substitution or malicious future releases. Because it is presented as the standard installation mechanism for additional skills, exploitation could propagate across the broader tool chain.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The intent phrases for the music portal include broad triggers like 'play music', 'free songs', and 'music portal', which overlap with ordinary user language. In an agent-routing context, overly broad triggers can cause unintended invocation of this skill, potentially redirecting user requests to external sites or tools the user did not explicitly ask to use.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The Haven Star Chart intent list contains very generic terms such as 'galaxy', 'nebula', 'cluster', and 'agent portal', which are likely to appear in benign conversation unrelated to this tool. In a routing manifest, such triggers can lead to accidental skill activation, context hijacking, or unintended navigation to external resources.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The install command uses npx clawhub@latest, which pulls whatever version is current at execution time rather than a reviewed, pinned release. If the upstream package is compromised or a breaking/malicious release is published, users and agents could execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This manifest advertises npx clawhub@latest install ..., leaving package resolution to the current latest npm release at runtime. That creates a software supply-chain exposure where a compromised or malicious update can be executed directly by users following the manifest.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Using npx clawhub@latest in a published manifest makes installations non-reproducible and trusts the npm registry's future state. An attacker who gains control of the package or publishing pipeline could weaponize installs into arbitrary code execution.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command references an unpinned latest package version, so execution depends on an external mutable source. That is dangerous because installation through npx executes package code immediately, amplifying the impact of any upstream compromise.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This install string relies on @latest, which is a mutable target and therefore weakens supply-chain integrity. Because users may copy-paste the manifest command directly, a malicious upstream release could convert documentation into an execution vector.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: npx clawhub@latest delegates trust to the most recent published package at install time, not the version reviewed when this manifest was authored. That creates a classic package-supply-chain risk with potential arbitrary code execution on the installing host.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The mutable latest tag makes this installation instruction unsafe from a reproducibility and provenance standpoint. If the referenced npm package is hijacked, the manifest could funnel users into running malicious code under the guise of a normal skill install.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Invoking npx against clawhub@latest means the code executed is not fixed by the manifest and may change at any time. In a tool-routing skill that encourages installation of many related skills, this increases systemic supply-chain exposure across the ecosystem.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The command points to a mutable package tag and would execute package-provided code when run. That is dangerous because a compromised upstream package could affect every consumer of this manifest without any change to the manifest itself.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Several clawhub skill intents in this section are generic phrases like 'memory', 'workflow orchestrator', 'knowledge base', or 'persona', which can collide with everyday user requests. In an agent ecosystem, that raises the risk of unintended installation suggestions, incorrect routing, or externally influenced tool selection without clear user intent.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: An unpinned npx package reference introduces a direct dependency on future package registry state. Since this manifest is effectively instructional code for operators and agents, an upstream compromise could produce broad arbitrary-code-execution risk.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This install instruction is vulnerable to supply-chain drift because @latest is not immutable. In practice, that means the command may execute code that was never reviewed by the manifest author or the downstream user.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Relying on the latest npm version at execution time is unsafe for a command intended to be copied and executed. Attackers frequently target package distribution channels, and npx will run the fetched package code directly.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The use of clawhub@latest creates a mutable trust dependency on an external registry entry. Because this file is a central manifest for routing to official tools, any compromised install path could mislead users into running malicious code with elevated trust.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This is a real supply-chain vulnerability: the package version is not pinned, yet the manifest encourages execution via npx. The combination of central discoverability plus direct execution increases the likelihood and blast radius of abuse if the upstream package is compromised.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The manifest's install command executes a package chosen by the moving latest tag instead of an immutable reviewed artifact. That undermines trust and can lead to arbitrary code execution through a malicious or hijacked release.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: Because npx runs remote package code, leaving the package at @latest exposes users to future unreviewed releases. In a manifest that lists numerous install targets, this pattern repeats a high-risk supply-chain weakness across multiple entries.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This command is another instance of a mutable npx dependency that can silently change behavior over time. If exploited through a compromised npm publication, it could result in remote code execution on systems that trust and follow this manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.