LYRA OpenClaw Hybrid

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:42 AM UTC
• Version: 1.0.0

Overview

The bundled skill is mostly a public documentation map plus a harmless self-check, but it directs users to unpinned external installs and describes sensitive automation that is not fully scoped inside this package.

Review and pin the installer and each related skill before installing. Treat the external OpenClaw/LYRA stack as separate code that needs its own audit, especially before granting browser-write, Discord, social posting, token-launch, memory, or local-secret access. Use an isolated environment without production secrets or wallet material until the full stack is verified.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:40

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 40-42
Vulnerability Type: Insecure dependency and supply-chain usage
Risk Level: Medium

Complete Code Snippet:

bash

npx clawhub@latest install deepseekoracle/lyra-open-claw
npx clawhub@latest install deepseekoracle/lygo-openclaw
npx clawhub@latest install deepseekoracle/lyra-brain

Technical Analysis

The installation instructions invoke npx clawhub@latest. The @latest tag is mutable and does not pin the executable package to a specific reviewed version or integrity hash. Consequently, following these instructions can retrieve and execute a future npm release whose contents differ from those available when this skill was audited.

The invoked tool also installs three remotely sourced skills. Two of those related skills are not included in this repository, so their code, instructions, permissions, and transitive dependencies are outside the audited scope. Project names, publisher names, signatures displayed in documentation, and repository URLs do not cryptographically verify the npm package or downloaded skill contents.

This creates a supply-chain trust boundary in which compromise of the npm package, its dependencies, its publisher account, or a remotely installed skill could cause unreviewed content to execute or become active on the operator's system.

Attack Path

1. An attacker compromises the clawhub npm publisher, a relevant dependency, or the distribution channel, or causes a malicious release to receive the latest tag.
2. Alternatively, an attacker compromises one of the remote skill packages referenced by the installation commands.
3. An operator follows the documented command using npx clawhub@latest.
4. npx downloads and executes the mutable package without enforcing a project-specified version or integrity digest.
5. The compromised installer or skill executes malicious code or introduces malicious instruction ...[truncated 819 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace clawhub@latest with an exact, reviewed package version.
2. Commit and enforce an npm lockfile containing integrity metadata where the installation workflow permits it.
3. Publish expected package checksums or signatures through a separately trusted channel and verify them before execution.
4. Pin each related skill to a reviewed immutable version, commit, or content digest rather than installing a mutable release.
5. Download and inspect packages before activation instead of combining retrieval and execution in a single npx operation.
6. Run installation with minimal privileges in an isolated environment that has no production secrets or sensitive wallet material.
7. Document the expected npm publisher identity and establish a release-verification and dependency-review process.

SkillSpector

Vulnerability Patterns

• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description presents a comprehensive hybrid agent/platform with many operational capabilities. The supplied code chunk does none of that. It is a standalone maintenance/security self-check script: it checks for required files (SKILL.md, LICENSE, claw.json, references/SECURITY.md), recursively scans certain file types, and fails if it finds strings matching rough secret patterns. This is a materially different primary purpose from the declared system behavior. While secret-related checking is tangentially security-oriented, it does not substantiate the broad claimed capabilities such as browser/Discord/social automation, token launches, memory layers, or access to absorbed brain structures and runtime keys.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 79% confidence

Finding

The skill advertises broad operational capabilities but does not declare an explicit tool scope such as permissions or allowed-tools. In agent ecosystems, missing scope boundaries can cause the runtime to over-trust the skill or leave tool access decisions implicit, which is risky for a package describing browser, Discord, posting, and token-launch workflows.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using 'npx clawhub@latest' executes whatever version is current at install time, which creates a supply-chain risk and makes builds non-reproducible. If the upstream package is compromised or a breaking version is published, operators could install malicious or unsafe code simply by following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using 'npx clawhub@latest' executes whatever version is current at install time, which creates a supply-chain risk and makes builds non-reproducible. If the upstream package is compromised or a breaking version is published, operators could install malicious or unsafe code simply by following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using 'npx clawhub@latest' executes whatever version is current at install time, which creates a supply-chain risk and makes builds non-reproducible. If the upstream package is compromised or a breaking version is published, operators could install malicious or unsafe code simply by following the documented command.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using 'npx clawhub@latest' executes whatever version is current at install time, which creates a supply-chain risk and makes builds non-reproducible. If the upstream package is compromised or a breaking version is published, operators could install malicious or unsafe code simply by following the documented command.

Content

No source excerpt is available for this finding.