Security audit

元呈 yotta-present

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a local presentation tool, but it asks for persistent control over future agent output and exposes a file-write path that can overwrite user-writable files.

Install only if you are comfortable with a presentation skill becoming a persistent default output layer. Prefer using the CLI for one-off rendering, decline writes to mcpServers or permanent memory unless you want cross-session behavior, avoid unpinned npx in sensitive environments, and do not let untrusted prompts choose SVG or output file paths.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Persistent Global Memory Rule Hijacks Future Agent Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/yotta_present_mcp.py:83
Finding: Persistent MCP Tool Allows Unrestricted Filesystem Overwrite
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:188
Finding: Documentation Recommends Unpinned Remote Package Execution
Content: View full analysis
npx -y @yottameta/yotta-present --dir npx -y @yottameta/yotta-present --list ``` The Skill also recommends another unaudited package in the same way: ```bash npx -y @yottameta/yotta-humanize --agent ``` ### Technical Analysis `npx` downloads and runs package code when the package is not already available locally. Omitting an exact version causes package resolution to depend on mutable registry state, normally the package's current distribution tag. The `-y` option suppresses the usual installation confirmation. Consequently, the code executed by these commands is not cryptographically tied to the audited artifact. A later compromised publication, maintainer-account takeover, malicious new release, or registry-level incident could cause users to execute different installer code. The optional `@yottameta/yotta-humanize` package is not present in this project and was not covered by this audit. Recommending its immediate execution extends the trust boundary to an unaudited external artifact. The audited `package.json` contains no dependency list or lifecycle hooks, and the bundled installer itself only performs local copies. Therefore, this finding concerns the documented retrieval and execution method rather than malicious behavior found in the bundled installer. ### Attack Path 1. An attacker compromises the publisher account, package distribution tag, or package release process. 2. The attacker publishes a malicious version under the referenced package name. 3. A user follows the documented `npx -y` command. 4. npm resolves the mutable current ...[truncated 805 chars]
Remediation: View remediation
``` 2. Avoid `-y` when interactive confirmation is practical. 3. Publish and document package integrity information, signed release provenance, and reproducible build instructions. 4. Recommend downloading and inspecting the package before executing its installer in sensitive environments. 5. Pin the optional package to a separately audited version and clearly state that it is outside this project's security boundary. 6. Use npm provenance or equivalent signed release attestations. 7. Document how users can verify the package contents against the corresponding source tag. 8. Prefer immutable release archives with verified checksums over mutable branch or distribution-tag references. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (42)

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill declares that by default nearly any final result delivered to the user should pass through this presentation layer. In an agent environment, such a broad trigger can cause the skill to intercept sensitive, security-critical, or context-specific outputs unexpectedly, increasing the chance of data overexposure, policy bypass, or inappropriate transformation of results.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: A cross-agent presentation skill should not implicitly double as a deployment mechanism that installs into agent directories or supports global setup across environments without prominent scoping. The mismatch increases the chance of overbroad trust, unintended persistence, and unsafe automation of filesystem changes under the guise of UI formatting.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: A cross-agent presentation skill should not implicitly double as a deployment mechanism that installs into agent directories or supports global setup across environments without prominent scoping. The mismatch increases the chance of overbroad trust, unintended persistence, and unsafe automation of filesystem changes under the guise of UI formatting.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill claims it should process virtually all user-facing AI output by default. Such an overbroad trigger can force unrelated content through a transformation layer, increasing exposure of sensitive data to extra tools/components, creating opportunities for output tampering, and making it harder for users or higher-priority policies to control when the skill runs.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The usage guidance routes all final outputs through the skill first, with exceptions only listed later. That default-first design is risky because it normalizes mandatory mediation of all responses, including security-sensitive or fidelity-critical content, before the user sees it.
Content: No source excerpt is available for this finding.

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · install.sh (reported line 66)May include surrounding context.
sh
install_to() { mkdir -p "$1/$SKILL_NAME" cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/" rm -rf "$1/$SKILL_NAME/.git" echo "installed -> $1/$SKILL_NAME" }

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The changelog states the skill is the default presentation layer for all AI outputs and that outputs should generally pass through it before reaching the user. Even though this is documentation rather than executable code, it promotes broad behavioral takeover without explicit per-use opt-in, which can override user expectations, alter outputs, and create a path for hidden formatting or policy-layer interference across unrelated tasks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The changelog documents automatic writing to MCP configuration and permanent memory on first use. Persistently modifying agent configuration or memory is security-sensitive because it can establish long-lived behavior changes, broaden future tool access, and survive the original session; mentioning a consent gate elsewhere does not remove the risk when this file still normalizes the behavior without a prominent direct warning.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The language selector presents English as the default primary language for the skill documentation, with Chinese as an alternate link, but there is no indication of user choice or locale negotiation in the skill behavior. Under the stated policy, forcing a specific language without opt-in is a natural-language locale policy concern unless clearly justified.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README recommends installation via npx from the npm registry without pinning a specific package version. This creates a supply-chain risk: future package updates, account compromise, or dependency tampering could cause users to fetch and execute unexpected code at install time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: This command executes an unpinned npm package directly with npx, which means the installed code can change over time without user review. If the package or publisher is compromised, users may run malicious installation or setup logic simply by following the documented command.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: The README instructs users to run npx against an unversioned package, exposing them to package drift and registry-side compromise. Because npx downloads and runs code, this is more than a documentation issue: it can directly lead to arbitrary code execution on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 98% confidence
Finding: Listing commands that use an unpinned npx package normalizes execution of mutable remote code from the registry. Even a benign project becomes a supply-chain entry point if its package, maintainer account, or transitive install path is altered after the README is published.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: 该文件是中文 README，并在页首语言切换处显示当前文档固定为“中文”。按规则，若技能以自然语言内容强制特定语言而没有用户选择或明确 opt-in，属于语言/locale 策略问题。
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The README instructs users to install and execute an npm package via npx -y @yottameta/yotta-present without pinning an exact version. This creates a supply-chain risk: future package updates, compromised maintainer accounts, or malicious dependency changes could cause users to run unreviewed code during installation or setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This line repeats the same unpinned npx installation pattern, which causes users to fetch and execute whatever version is current at runtime. In an agent-skill context, installation commands may be followed with less scrutiny, increasing exposure to package hijacking or malicious updates.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: Even though this invocation is only for listing mappings, it still runs the package via unpinned npx, which means arbitrary package code may execute before producing output. The context is less dangerous than a persistent install, but it still exposes users to the same package-substitution and malicious-update risks.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill instructs the agent to read/write client configuration and persistent memory, and to invoke local Python/CLI tooling, but it does not declare any explicit tool scope or permission boundaries. This creates an authorization gap where a seemingly harmless presentation skill can perform filesystem and shell-adjacent actions without clear least-privilege constraints or user-visible scoping.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The skill language mandates default presentation behavior for all outputs without meaningful user choice at time of use. While not directly code execution, this weakens user agency and can cause unintended processing of content through formatting logic or resident tools, especially when combined with persistent MCP setup.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The skill recommends running an unpinned npx -y @yottameta/yotta-humanize, which pulls the latest package version at execution time. That creates a supply-chain risk: a compromised publisher account, malicious new release, or breaking update could cause arbitrary code execution or unexpected behavior on the user's machine.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.