Skills/Glama/lykos

lykos@0.0.1

CAUTION· install only

Publisher claims: "Serves an orchestrating agent over stdio, letting it start background coding sessions without waiting, check their status, steer or stop them, and call specialists as its own tools. Results distinguish work that was actually verified from what the worker merely claims." Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry GlamaPublisher rakun68 · publishing for 2 daysInstalls 0Last detonated 2d ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

What this means for the label: Caution here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.

Before you give it your token

It will ask for
GIT_AUTHOR_EMAILGIT_AUTHOR_NAMESCHEMA_TOKENS_BASISConfiguration, not credentials: BUDGET_KEYS, COLUMNS, EVAL_PYTHON_CONFIG_KEY, GIT_COMMITTER_EMAIL, GIT_COMMITTER_NAME, LINES, LYKOS_ASK_OUTCOME, LYKOS_BUDGET_PER_DAY_USD, LYKOS_BUDGET_PER_RUN_USD, LYKOS_COMPACTION_THRESHOLD, LYKOS_HUD, LYKOS_LEDGER_PATH, LYKOS_MODEL_DEFAULT, LYKOS_OUTPUT_DIET, LYKOS_PROMPT_DIET, LYKOS_TRUST_WORKSPACE, LYKOS_UI_THEME
Where it talks to
no vendor host named in the code
What the honeypot saw
no credential files read · no network
What we could not test
use of the skill by an agent

Connect it with a scoped credential, under the guard. It asks for GIT_AUTHOR_EMAIL, GIT_AUTHOR_NAME, SCHEMA_TOKENS_BASIS and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.

$vet-skills run --net declared -- <the server's command>

Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-12 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

HIGH
Access to sensitive file pathslykos/loop/hooks.ts:459 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...process.env, ...env },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
File type combined with upload actionlykos/cli/show.ts:370 · File type combined with upload action — agent may exfiltrate local data files* T54: the resume contract, printed from `meta.json` rather than recomputed.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelykos/cli/mcp.ts:4 · npx invocation of non-well-known package — may execute untrusted code// claude mcp add lykos -- npx -y lykos mcpFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlykos/loop/hooks.ts:426 · Process kill command — agent can terminate processes* started still running. The kill is `killProcessTree`, the same one `hub`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagelykos/cli/brief.ts:4 · npx invocation of non-well-known package — may execute untrusted code// (`npm run dev -- run "..."`, `npx lykos`, `lykos.cmd` from `cmd.exe` or aFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlykos/cli/tools.ts:5 · Process kill command — agent can terminate processes// promotes or deletes a tool. ADR-0014's kill criterion is worded `suggests`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/tui/editor.ts:9 · Process kill command — agent can terminate processes// word, standard kill bindings, and no rendering of its own — theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/tools/hub.ts:38 · Process kill command — agent can terminate processes// kills a process this same session started and would kill at teardown anywayFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandlykos/cli/doctor.ts:474 · Privileged sudo command — agent may execute with elevated privilegesString.raw`podman machine ssh "printf '[engine]\ncgroup_manager = \042cgroupfs\042\n' | sudo tee /etc/containers/containers.conf.d/50-cgroupfs.conf"`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/cli/tools.ts:70 · Process kill command — agent can terminate processes/** ADR-0014's kill criterion is stated in ninety days, so that is the default window. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/loop/hooks.ts:431 · Process kill command — agent can terminate processes* kill must not become a deny of the tool call the hook was watching.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/loop/hooks.ts:427 · Process kill command — agent can terminate processes* and the post-edit runner use, and it has to be async: a tree kill cannotFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/cli/search.ts:67 · Process kill command — agent can terminate processes/** Sessions whose last line did not parse (a kill mid-write). The hits above them are still real. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/cli/budget.ts:4 · Process kill command — agent can terminate processes// fast cache T7's kill switch itself reads before every gated call — thisFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/tui/editor.ts:540 · Process kill command — agent can terminate processes// --- kill bindings ---Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlykos/cli/tools.ts:479 · Process kill command — agent can terminate processesstdoutWrite(`\nninety-day suggestion — the phase's armed kill criterion (ADR-0014)\n`);Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandlykos/cli/doctor.ts:473 · Privileged sudo command — agent may execute with elevated privileges'podman machine ssh "sudo mkdir -p /etc/containers/containers.conf.d"',Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05

Cost to the agent

Instructions loaded
≈1,012 tok
2 files · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim rakun68: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  3. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
  6. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
Publish a new version to Glama, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim rakun68Propose a patch to the maintainer