Yapi

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:53 AM UTC
• Version: 1.0.1

Overview

The skill is coherent for YApi documentation work, but it tells the agent to run an unpinned npm package that can execute changing third-party code while handling YApi auth and local project files.

Review this before installing in a sensitive environment. Prefer a preinstalled or pinned, reviewed yapi/@leeguoo/yapi-mcp version, avoid the unpinned npx fallback, and be aware that the tool may use local YApi configuration, cached auth, project docs, and can perform real docs sync after dry-run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:10

Finding

Unpinned Third-Party Package Execution Through npx

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 10–17
Vulnerability Type: Unpinned and automatically executed third-party dependency
Risk Level: Medium

Vulnerable Code

markdown

## Command policy

Prefer `yapi` command. If missing, fallback to one-shot npx without forcing global install:

```bash
yapi -h
# fallback:
npx -y @leeguoo/yapi-mcp -h

In command examples below, yapi can be replaced by npx -y @leeguoo/yapi-mcp.

text

### Technical Analysis

The documented fallback invokes `@leeguoo/yapi-mcp` through `npx -y` without specifying an exact package version or verifying package integrity. Consequently, npm resolves the package to whatever version is current under the applicable registry and configuration when the command runs.

The `-y` option suppresses installation confirmation, enabling newly downloaded package code to execute without an explicit user approval step. npm package lifecycle behavior and the invoked CLI entry point can execute code with the permissions of the account running the agent. The effective code may therefore change after the skill has been reviewed.

This creates a supply-chain exposure rather than evidence that the named package is currently malicious. Exploitation would require compromise or malicious alteration of the package, its publisher account, its dependency chain, or the package registry/resolution environment.

### Attack Path

1. The agent attempts to use the preferred local `yapi` executable, but it is unavailable.
2. Following the skill instructions, the agent runs:
   ```bash
   npx -y @leeguoo/yapi-mcp -h

3. npm resolves an unpinned version from the configured registry and downloads it and any required dependencies.
4. A compromised package version, dependency, publisher account, or registry response supplies attacker-controlled code.
5. Package lifecycle code or the CLI entry point executes under the agent user's identity.
6. The malicious code accesses resources available ...[truncated 654 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed exact version rather than allowing mutable registry resolution:

   bash

   npx -y @leeguoo/yapi-mcp@X.Y.Z -h
   

2. Prefer installing the dependency through a committed lockfile with verified integrity metadata, followed by execution without downloading:

   bash

   npx --no-install @leeguoo/yapi-mcp -h
   

3. Remove -y where practical so that an unexpected installation requires explicit approval.
4. Document a trusted registry and enforce npm configuration that prevents dependency-confusion resolution through untrusted registries.
5. Review the pinned package, transitive dependencies, lifecycle scripts, and published provenance before approval.
6. Run the CLI with least privilege in a sandbox or container, limiting filesystem and network access to the resources necessary for YApi operations.
7. Restrict access to YApi authentication caches and avoid exposing unrelated credentials or sensitive environment variables to the CLI process.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The skill instructs use of npx -y @leeguoo/yapi-mcp without pinning a specific version. That causes retrieval and execution of whatever package version is current at runtime, creating a supply-chain risk if the package is compromised, maliciously updated, or unexpectedly changed; the danger is increased because this skill also handles auth state and local config paths, so a malicious package could access tokens or user files.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This line repeats the same unsafe fallback pattern by allowing command examples to substitute yapi with npx -y @leeguoo/yapi-mcp, again without a pinned version. In context this broadens exposure because it normalizes repeated execution of an unpinned remote package throughout the workflow, including operations involving YApi authentication and local cache/config files.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.