Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- scripts/_stack_tools.py:30
- Evidence
spec.loader.exec_module(mod)
Security audit
LYGO Lattice Pulse
Security checks across malware telemetry and agentic risk
Overview
This skill is a disclosed, read-only LYGO verification and readiness plugin with proportionate local-file and public-registry access.
Install only if you intend to connect OpenClaw to a LYGO stack clone. Set stackRoot or LYGO_STACK_ROOT to a trusted local clone, keep pagesBase pointed at a trusted registry source, and treat the bundled Python gate helper as an explicit terminal action rather than automatic plugin behavior.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dynamic_code_execution