Security audit

LYRA 3-Brain Memory

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local-memory skill, but it needs Review because its install path and file-writing/import behavior are broader and less contained than its safety text implies.

Install only if you trust both the clawhub installer you run and the LYRA_CORE_ROOT tree you point this at. Use a controlled LYRA core directory, avoid shared or writable-by-others locations, do not store secrets or personal data, and be aware that repeated slugs may overwrite prior memory files.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/session_log_snip.py:47
Finding: Unsanitized Path Components Permit Out-of-Scope File Writes and Overwrites
Content: View full analysis
{args.ref_to}\nfile: {path.name}\n", encoding="utf-8", ) ``` ### Technical Analysis The user-controlled `slug` and `ref_to` arguments are interpolated directly into filesystem paths. The implementation does not reject path separators, traversal components such as `..`, absolute-path syntax, or paths resolving through symbolic links. It also does not resolve the final destination and verify that it remains beneath the intended `LYRA_CORE_ROOT/memory` directory. The date and static filename prefixes limit simple traversal strings because any prefixed intermediate directory must exist. However, traversal can still become exploitable where a corresponding directory or symbolic link already exists beneath the memory tree. This is particularly relevant on shared systems or where another process can prepare entr ...[truncated 1758 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:69
Finding: Installation Instructions Execute a Mutable Unpinned Package Version
Content: View full analysis
Remediation: View remediation
install deepseekoracle/lyra-brain ``` 2. Publish and verify a cryptographic integrity hash or signed release artifact. 3. Use a lockfile or other reproducible dependency mechanism where applicable. 4. Document how users can verify the package publisher, resolved version, and artifact integrity before execution. 5. Advise users to run the installer with the minimum required privileges and in an isolated environment when practical. ]]>

T08 · Insecure Dependencies

Warning

Location: scripts/brain_grow_cli.py:47
Finding: External LYRA Core Modules Are Imported and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: Using npx clawhub@latest install ... pulls and executes the most recent package version at install time, creating a supply-chain risk if the package is compromised or a breaking/malicious release is published. Because this skill manages local persistent storage and instructs users to install and run tooling, an attacker controlling that dependency could gain code execution during installation or alter the installed skill behavior.
Content: No source excerpt is available for this finding.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 75% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/SECURITY.md (reported line 38)May include surrounding context.
md
|--------|------| | Write snip / daily index / ref | `--i-consent` on `session_log_snip.py` | | Grow graph | `--i-consent` on `brain_grow_cli.py` or on snip with `--grow` | | Recall | read-only; no consent flag | Agents must obtain **explicit user request** for persistent memory before invoking write CLIs.

Ae4

Medium

Category: analysis-evasion
Confidence: 80% confidence
Finding: Suspicious Unicode normalization or mixed-script content
Content: No source excerpt is available for this finding.