Skills/ClawHub/lygo-llm-console

lygo-llm-console@2.0.3

VERIFIED

Publisher claims: "Use when an operator asks for the sovereign LYGO LLM Console, console 1.7.0, a local GGUF agent portal, or the online API portal. This is a pointer-only skill: it bundles no runtime, no Python, no executables and runs nothing on install. It links to the official chatagent.ca downloads, the SkillHub FULL vault, the 1.7.0 GitHub source and the API portal, with hash verification and an unprivileged-user warning. Not Ollama. Not a sandbox. No cloud inference." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher deepseekoracle · joined 2 days agoInstalls 630Last detonated 30 h ago
$clawhub install lygo-llm-console
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-10-27 and scored it 84/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

MEDIUM
URL using raw IP addressSKILL.md:49 · URL using raw IP address — may bypass domain-based filteringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Outbound HTTP to raw IP addressSKILL.md:49 · Outbound HTTP to raw IP address — may bypass domain-based monitoringFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.
AST07
HIGH
Auto-update or dynamic fetch configurationclaw.json:49 · Auto-update or dynamic fetch configuration — agent may load new code at runtimeFix: Pin versions and sources; vendor anything fetched at install time.
AST06