Security audit

LYGO Universal Living Memory Library (v1.2)

Security checks for vulnerabilities and agentic risk

Overview

This skill is mainly a local memory audit/archive helper, but it needs review because its local file scope and publication/install guidance are not tight enough for sensitive memory data.

Review before installing. Use a pinned ClawHub installer and pinned skill/verifier versions, run it only against a deliberately chosen LYGO_AUTHORITY_ROOT, inspect core_files_index.json for absolute paths, traversal, and symlinks, and do not mint or publicly anchor archives until secrets, personal data, and private conversation content have been removed. Expect local files to be written: an audit report under a state directory and MASTER_ARCHIVE.md unless an explicit output path is used.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:23
Finding: Unpinned Runtime Package Installation Creates a Mutable Supply-Chain Risk
Content: View full analysis
Remediation: View remediation
install deepseekoracle/lygo-universal-living-memory-library@ ``` 2. Pin the companion verifier to an exact version as well. 3. Publish and verify cryptographic integrity values for the installer and downloaded Skill artifacts. 4. Use a lockfile or equivalent immutable dependency manifest for installer dependencies. 5. Avoid executing registry-fetched tools directly where possible. Install a verified release first, then invoke the locally verified binary. 6. Document the expected publisher identity, package version, artifact digest, and verification procedure. 7. Perform installation under a minimally privileged account and never recommend administrative execution unless strictly necessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/audit_library.py:64
Finding: Indexed Paths Are Not Restricted to the Declared Authority Root
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description describes a large multifunction library with several domain-specific capabilities and integrations. The supplied code chunk is only a small utility script that accesses a local JSON reference file and prints one provenance-related hash value. While the hash relates loosely to 'LYGO-MINT provenance,' the overall declared purpose materially overstates and misrepresents the code's actual behavior and primary purpose.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises executable commands that read environment variables and operate on local files, but it does not declare an explicit tool/permission scope. That ambiguity increases the chance an agent or user will grant broader filesystem access than necessary, especially given the skill's focus on memory archives and authority-root paths.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: Using 'npx clawhub@latest install ...' pulls and executes the latest published package version, which is a supply-chain risk because future package updates could introduce malicious or unsafe behavior. Since this is an installation path for a skill ecosystem, an attacker who compromises the upstream package or publishing account could gain code execution on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The documentation instructs users to 'Compress living memory into MASTER_ARCHIVE.md' without clearly warning that this may create, overwrite, or consolidate sensitive local content. In the context of a memory/archive skill operating over authority-root paths, unclear write semantics can cause accidental data loss or unintended aggregation of secrets into a single high-value file.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: This second 'npx clawhub@latest' reference repeats the same unpinned execution risk, again allowing whatever code is current at publish time to run locally. Repetition increases exposure because users may treat the command as a trusted standard workflow and execute it without scrutinizing package integrity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The protocol explicitly tells users to "anchor it publicly" after compressing arbitrary logs, scrolls, seals, or conversation exports, but provides no safeguards for redaction, consent, or data classification. In the context of a memory/archive skill handling conversational and continuity data, this creates a real risk of leaking sensitive personal, operational, or proprietary information into an irreversible public record.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script advertises itself as a 'pure advisor' that performs local inspection only, but it also creates a state directory and writes an audit report to disk. This mismatch is dangerous because operators or higher-level agents may trust the script as read-only and run it in sensitive workspaces where even local writes can alter state, break immutability assumptions, or trigger downstream automation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The docstring explicitly says 'Pure advisor: local inspection only,' yet the implementation performs filesystem writes via mkdir() and write_text(). In an agent-skill context, misleading side-effect claims are security-relevant because orchestration layers may whitelist or auto-execute 'read-only' skills under stricter trust assumptions than state-mutating ones.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.