Security audit

LYGO Continuum

Security checks across malware telemetry and agentic risk

Overview

This is a local verification skill whose filesystem access is mostly confined and disclosed, with an explicit but powerful output-path override users should avoid unless intentional.

Install is reasonable for local work-receipt use. Keep --base set to the intended project, review claims or capsules from others before verifying, avoid putting secrets in task summaries or handoff text, and do not use --i-allow-any-out unless you deliberately want the skill to overwrite a specific path outside the project/state areas.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The write-authorization logic explicitly permits arbitrary filesystem writes when `--i-allow-any-out` is set, which contradicts the skill's stated confinement model. In an agent setting, this weakens a key safety boundary: a caller or prompt-influenced invocation can redirect outputs outside the intended workspace or state directory and overwrite unintended files accessible to the process.

Intent-Code Divergence

Medium

Confidence: 98% confidence
Finding: The module documentation asserts that writes are confined under `--base` or `state/` with consent, but the implementation includes a bypass allowing writes anywhere. This mismatch is security-relevant because agents, operators, and downstream tooling may trust the documented boundary and use the skill in higher-trust contexts, creating a confused-deputy risk when the hidden broader write capability is available.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.