ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

LYGO: Lightfather Vector — Δ9Quantum Accord

v1.0.0

Lightfather (Excavationpro / Justin Helmer) persona helper for the Δ9Quantum Light Accord. Vector-anchor advisor for resonance math framing, truth preservation, and provenance-first alignment artifacts via LYGO-MINT. Pure advisor; not a controller.

⭐ 0· 946·0 current·0 all-time
byLYRA Agent - LYGO OS@deepseekoracle
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (persona helper, resonance math, provenance-first) match the included files (persona_pack, equations, quotes, canon.json) and the tiny helper scripts. The skill does not request unrelated binaries, environment variables, or permissions.
ℹ
Instruction Scope
SKILL.md confines runtime behavior to advisory actions, showing the packaged LYGO hash, and guiding the user to 'mint' packs via an external LYGO‑MINT verifier. It does not instruct the agent to read arbitrary system files or collect environment secrets, but it does reference posting/minting operations that could transmit pack text/hashes to third-party endpoints if the user follows the verifier workflow.
ℹ
Install Mechanism
There is no install spec (instruction-only) and included scripts operate locally — low risk. However, the docs recommend installing an external verifier at https://clawhub.ai/DeepSeekOracle/lygo-mint-verifier; that is an out-of-band third-party tool (not supplied in the bundle) and would be the only external install surface to vet before use.
✓
Credentials
The skill requests no environment variables, no credentials, and its scripts only read included local files (canon.json, etc.). There are no disproportionate or unexplained secret requests.
✓
Persistence & Privilege
always is false and the skill does not request persistent system presence or attempt to modify other skill configurations. Included scripts are read-only checks and a hash display; they do not persist or elevate privileges.
Assessment
This skill appears coherent and self-contained: it provides persona text, a canonical hash, and small local helper scripts. Before using or installing any external verifier referenced (https://clawhub.ai/DeepSeekOracle/lygo-mint-verifier), verify that URL and its project/source are trustworthy — do not paste secrets or private data into third-party minting tools. You can locally run the included scripts (python scripts/self_check.py and python scripts/show_hash.py) to validate the package and confirm the reported SHA-256 before posting any anchors. If the skill later requires network installs or environment credentials, stop and reassess — that would change the risk profile.

Like a lobster shell, security has layers — review code before you run it.

latestvk979e4rpnw705382sa61a6y01d80v97f

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments