LYGO Universal Living Memory Library (v1.2)

• Outcome: Review
• Latest audit: Sep 10, 2026 · 3:31 PM UTC
• Version: 1.2.0

Overview

This skill is mainly a local memory audit/archive helper, but it needs review because its local file scope and publication/install guidance are not tight enough for sensitive memory data.

Review before installing. Use a pinned ClawHub installer and pinned skill/verifier versions, run it only against a deliberately chosen LYGO_AUTHORITY_ROOT, inspect core_files_index.json for absolute paths, traversal, and symlinks, and do not mint or publicly anchor archives until secrets, personal data, and private conversation content have been removed. Expect local files to be written: an audit report under a state directory and MASTER_ARCHIVE.md unless an explicit output path is used.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:23
• Finding: Unpinned Runtime Package Installation Creates a Mutable Supply-Chain Risk<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-25` and `SKILL.md:77-81` **Vulnerability Type**: Unpinned executable dependency installation **Risk Level**: Medium ### Complete Code Snippet ```markdown ## Install ```bash npx clawhub@latest install deepseekoracle/lygo-universal-living-memory-library export LYGO_AUTHORITY_ROOT="I:/E Drive" export LYGO_STACK_ROOT="I:/E Drive/lygo-protocol-stack" ``` ``` The companion verifier is installed in the same manner: ```markdown ## Verifier companion ```bash npx clawhub@latest install deepseekoracle/lygo-mint-verifier ``` ``` ### Technical Analysis The documented installation commands invoke `npx` with the mutable `clawhub@latest` package version. `npx` may download and execute package code from the configured package registry. Because `latest` is not immutable, the package executed in the future may differ from the version that was reviewed during this audit. The requested Skills are also identified only by publisher and package name, without an exact version or cryptographic integrity value. This creates a supply-chain trust dependency on: - The package registry and its configured resolution behavior. - The `clawhub` publisher account. - The Skill publisher account. - Future releases assigned to the `latest` tag. - Transitive dependencies used by the installer. The audited Python scripts themselves perform no network retrieval or process execution. The risk arises from the installation instructions rather than from hidden runtime behavior in those scripts. ### Attack Path 1. An attacker compromises a relevant registry or publisher account, or introduces a malicious future release into the dependency chain. 2. The malicious release is assigned to the mutable `latest` tag or otherwise becomes the version resolved by `npx`. 3. A user follows the installation command from `SKILL.md`. 4. `npx` retrieves and executes the changed package. 5. The malicious package runs with the permissions of the i ...[truncated 606 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `clawhub@latest` with an exact, reviewed version: ```bash npx clawhub@<exact-version> install deepseekoracle/lygo-universal-living-memory-library@<exact-version> ``` 2. Pin the companion verifier to an exact version as well. 3. Publish and verify cryptographic integrity values for the installer and downloaded Skill artifacts. 4. Use a lockfile or equivalent immutable dependency manifest for installer dependencies. 5. Avoid executing registry-fetched tools directly where possible. Install a verified release first, then invoke the locally verified binary. 6. Document the expected publisher identity, package version, artifact digest, and verification procedure. 7. Perform installation under a minimally privileged account and never recommend administrative execution unless strictly necessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/audit_library.py:64
• Finding: Indexed Paths Are Not Restricted to the Declared Authority Root<![CDATA[ ## Vulnerability Details **File Location**: `scripts/audit_library.py:64-83` and `scripts/compress_master.py:37-47` **Vulnerability Type**: Unrestricted path resolution and local file access **Risk Level**: Medium ### Complete Code Snippet The audit script resolves index entries but does not verify that the result remains under `base`: ```python for it in items: rel = it.get("path") role = it.get("role") tags = set(it.get("tags") or []) p = (base / rel).resolve() exists = p.exists() row: dict = { "path": rel, "role": role, "tags": sorted(tags), "exists": exists, } if not exists: missing.append(rel) else: st = p.stat() row["mtime"] = int(st.st_mtime) row["size"] = int(st.st_size) if p.is_file(): row["sha256"] = sha256_file(p) ``` The compression script similarly accepts index paths without containment validation: ```python for it in items: rel = it.get("path", "") role = it.get("role", "") p = base / rel if not p.exists(): lines.append(f"| `{rel}` | {role} | MISSING | — |") continue st = p.stat() if p.is_file(): digest = sha256_file(p)[:16] + "…" lines.append(f"| `{rel}` | {role} | {st.st_size} | `{digest}` |") ``` ### Technical Analysis Paths are loaded from the editable `references/core_files_index.json` configuration and joined to the authority root. Neither script rejects: - Absolute paths. - Relative traversal components such as `../`. - Symlinks that resolve outside the authority root. - Non-string or otherwise malformed path fields. In `audit_library.py`, calling `.resolve()` normalizes traversal and follows symlinks, but there is no subsequent containment check such as `p.is_relative_to(base)`. Resolution therefore does not provide sandboxing. In `compress_master.py`, paths are not resolved before use and are likewise not checked for containment. Files outside th ...[truncated 2158 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve the authority root once and require every candidate to remain beneath it: ```python base = base.resolve() if not isinstance(rel, str) or not rel: raise ValueError("Index path must be a non-empty string") rel_path = Path(rel) if rel_path.is_absolute(): raise ValueError(f"Absolute index path is prohibited: {rel}") candidate = (base / rel_path).resolve(strict=False) if not candidate.is_relative_to(base): raise ValueError(f"Index path escapes authority root: {rel}") ``` 2. Apply the same shared path-validation function in both `audit_library.py` and `compress_master.py`. 3. Decide whether symlinks are legitimate. If they are not required, reject any indexed path containing a symlink component. 4. Validate the complete index schema before processing it, including the types and permitted values of `path`, `role`, and `tags`. 5. Reject traversal components such as `..` before access, in addition to performing canonical containment validation. 6. Consider regular-file checks and configurable file-size limits before hashing to reduce denial-of-service exposure. 7. Record rejected paths as security validation errors without accessing or hashing their targets. 8. Add automated tests covering absolute paths, `../` traversal, nested traversal, symlink escapes, malformed fields, and valid paths beneath the authority root. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description describes a large multifunction library with several domain-specific capabilities and integrations. The supplied code chunk is only a small utility script that accesses a local JSON reference file and prints one provenance-related hash value. While the hash relates loosely to 'LYGO-MINT provenance,' the overall declared purpose materially overstates and misrepresents the code's actual behavior and primary purpose.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises executable commands that read environment variables and operate on local files, but it does not declare an explicit tool/permission scope. That ambiguity increases the chance an agent or user will grant broader filesystem access than necessary, especially given the skill's focus on memory archives and authority-root paths.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: Using 'npx clawhub@latest install ...' pulls and executes the latest published package version, which is a supply-chain risk because future package updates could introduce malicious or unsafe behavior. Since this is an installation path for a skill ecosystem, an attacker who compromises the upstream package or publishing account could gain code execution on the user's machine.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The documentation instructs users to 'Compress living memory into MASTER_ARCHIVE.md' without clearly warning that this may create, overwrite, or consolidate sensitive local content. In the context of a memory/archive skill operating over authority-root paths, unclear write semantics can cause accidental data loss or unintended aggregation of secrets into a single high-value file.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence
• Finding: This second 'npx clawhub@latest' reference repeats the same unpinned execution risk, again allowing whatever code is current at publish time to run locally. Repetition increases exposure because users may treat the command as a trusted standard workflow and execute it without scrutinizing package integrity.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The protocol explicitly tells users to "anchor it publicly" after compressing arbitrary logs, scrolls, seals, or conversation exports, but provides no safeguards for redaction, consent, or data classification. In the context of a memory/archive skill handling conversational and continuity data, this creates a real risk of leaking sensitive personal, operational, or proprietary information into an irreversible public record.

Ae4

Medium

• Category: analysis-evasion
• Confidence: 80% confidence
• Finding: Suspicious Unicode normalization or mixed-script content

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The script advertises itself as a 'pure advisor' that performs local inspection only, but it also creates a state directory and writes an audit report to disk. This mismatch is dangerous because operators or higher-level agents may trust the script as read-only and run it in sensitive workspaces where even local writes can alter state, break immutability assumptions, or trigger downstream automation.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The docstring explicitly says 'Pure advisor: local inspection only,' yet the implementation performs filesystem writes via mkdir() and write_text(). In an agent-skill context, misleading side-effect claims are security-relevant because orchestration layers may whitelist or auto-execute 'read-only' skills under stricter trust assumptions than state-mutating ones.

Static analysis

No suspicious patterns detected.