蚁小二一键发布

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:39 AM UTC
• Version: 1.6.5

Overview

This bootstrap skill is openly for installing a CLI and syncing another skill, but it defaults to mutable global installs, global remote skill synchronization, and command-line API key handling.

Install only if you trust the yixiaoer publisher and are comfortable with global changes to your CLI and agent skill environment. Prefer a pinned reviewed version, avoid putting real API keys directly in chat or shell commands, and consider local sync/install options unless you specifically need global availability.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:31

Finding

Mutable npm Package Is Installed Globally Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:31-35
Additional Locations: SKILL.md:76-81, SKILL.md:100-104, README.md:14-18
Vulnerability Type: Supply-chain compromise through a mutable dependency and global installation
Risk Level: High

Vulnerable Code:

shell

npm install -g @yixiaoermail/cli@latest

The upgrade and troubleshooting procedures repeat the same unpinned global installation:

shell

npm install -g @yixiaoermail/cli@latest
yxer --version
yxer skill sync --global
yxer doctor

Technical Analysis

The Skill directs the Agent to install the @yixiaoermail/cli npm package using the mutable latest distribution tag. It does not pin an audited version, verify an integrity digest, validate package provenance, or otherwise ensure that the downloaded package is the version that was reviewed.

An npm installation may execute package lifecycle scripts such as preinstall, install, and postinstall. Because the installation is global, package files and executable entry points are written outside the project directory and become available throughout the invoking user's environment. Consequently, the effective code executed during installation can change independently of this Skill after its review.

No evidence in the audited files proves that the current npm package is malicious. The vulnerability is the unsafe trust and installation model.

Attack Path

1. An attacker compromises the npm publisher account, package release workflow, registry resolution path, or another component of the package supply chain.
2. The attacker publishes a malicious package version and assigns it to the latest tag.
3. A user or Agent follows the Skill and runs:

   shell

   npm install -g @yixiaoermail/cli@latest
   

4. npm downloads the attacker-controlled release.
5. Malicious lifecycle scripts or package installation logic execute with the privileges of the u ...[truncated 675 chars]

Remediation

View remediation

Remediation Suggestions

• Replace @latest with an exact, reviewed package version.
• Record and verify the expected package integrity digest and publisher provenance before installation.
• Prefer a project-local installation over npm install -g, and invoke the pinned local executable.
• Use a lockfile or another immutable dependency manifest where the deployment model permits it.
• Review package lifecycle scripts and consider disabling them during installation when they are not required.
• Execute installation in a sandbox or restricted account with minimal filesystem, credential, and network access.
• Require explicit user confirmation before any global installation.
• Establish a controlled upgrade process in which each new version is reviewed before changing the pinned version.

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:53

Finding

Unreviewed External Skill Is Synchronized at Global Scope

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:53-62
Additional Locations: SKILL.md:76-81, SKILL.md:100-104, README.md:24-28
Vulnerability Type: Remote payload retrieval with unnecessarily broad installation scope
Risk Level: High

Vulnerable Code:

shell

yxer skill sync --global

The Skill explicitly establishes global synchronization as the default:

markdown

- `yxer skill sync --global` is the bootstrap skill's default synchronization method.
- If the user explicitly wants visibility only in the current host and does not require global installation, `yxer skill sync` may be used instead.

The documented upgrade workflow also retrieves the external Skill globally:

shell

npm install -g @yixiaoermail/cli@latest
yxer --version
yxer skill sync --global
yxer doctor

Technical Analysis

The command retrieves and installs or updates a separate yixiaoer Skill that is not included in the audited artifact. The project contains only README.md, SKILL.md, and plugin.json; therefore, the source, version, integrity, behavior, and instructions of the synchronized Skill could not be reviewed.

The external Skill can change after this bootstrap package has been audited. Synchronizing it creates a remote payload channel through which new Agent instructions or executable content may enter the environment. Using --global increases the affected scope by making the synchronized content available beyond the current project or host context.

The command is consistent with the documented bootstrap purpose, and there is no direct evidence that the remote Skill is currently malicious. The security issue is that unpinned, unverified external content is retrieved into global scope by default.

Attack Path

1. An attacker compromises or gains control of the remote Skill source, publication account, synchronization service, or delivery infrastructure.
2. The attacker ...[truncated 1082 chars]

Remediation

View remediation

Remediation Suggestions

• Bundle the reviewed yixiaoer Skill with the package or reference it by an immutable version and cryptographic digest.
• Document the authoritative source and verify signatures or integrity metadata before installation.
• Default to local synchronization without --global.
• Require explicit, informed user approval before global synchronization.
• Display the exact version, source, files, and permissions that will be installed before applying changes.
• Review synchronized content before activation and reject unexpected executable files or instruction changes.
• Isolate remotely synchronized Skills and restrict their tool, filesystem, credential, and network permissions.
• Implement a rollback mechanism and maintain an audit log of synchronized versions and integrity values.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:64

Finding

API Key Is Passed Through a Command-Line Argument

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:64-73
Additional Location: README.md:30-34
Vulnerability Type: Sensitive credential exposure through command-line handling
Risk Level: Medium

Vulnerable Code:

shell

yxer config init --api-key <apiKey>

The accompanying instruction asks the Agent to obtain a valid API key before executing this command:

markdown

- Have the user provide a valid API Key before execution.
- If the current environment is already configured, this step may be skipped.

Technical Analysis

Passing a secret directly as a command-line argument can expose it through shell history, terminal transcripts, command logging, process inspection, audit systems, automation logs, or error reports. The exact exposure depends on the operating system, shell, host configuration, and CLI implementation, but command-line arguments are generally not an appropriate secret transport mechanism.

Asking the user to provide the key to the Agent can also cause the credential to enter conversation records or other host telemetry. The audited documentation does not specify redaction, hidden input, secure storage, restrictive file permissions, or log-suppression requirements.

Attack Path

1. A user supplies a valid API key and substitutes it into the documented command.
2. The Agent or user executes:

   shell

   yxer config init --api-key REAL_SECRET_VALUE
   

3. The full command is captured in shell history, process metadata, terminal logging, Agent tool records, telemetry, or diagnostic output.
4. A local user, administrator, support operator, log reader, or compromised process obtains access to that record.
5. The exposed key is extracted and used to authenticate to the associated service.

Impact Assessment

An attacker can obtain the privileges granted to the exposed API key. The precise scope cannot be determined from the audited files becaus ...[truncated 315 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the command-line option with an interactive hidden prompt that does not echo the secret.
• Support reading the key from a protected file descriptor or operating-system secret store.
• If environment-based input is unavoidable, avoid printing the environment and unset the variable immediately after use.
• Do not ask users to place API keys in Agent conversations or ordinary terminal commands.
• Redact secrets from command traces, diagnostic output, telemetry, error messages, and support bundles.
• Store the resulting configuration with permissions limited to the owning user.
• Document key rotation and immediate revocation procedures for suspected exposure.
• Encourage narrowly scoped, short-lived credentials rather than broad, long-lived API keys.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README instructs users to pass an API key directly on the command line via yxer config init --api-key <apiKey>, but provides no warning about secure credential handling. Command-line secrets can be exposed through shell history, process listings, terminal logs, screenshots, or CI logs, making accidental credential disclosure more likely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The visible title and operational instructions are entirely in Chinese and are directed at the AI agent, but the file does not state that the skill is intended only for Chinese-speaking users or offer any language/locale choice. Under the policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions in the file are in Chinese, and the document does not indicate that the skill is region-specific or provide an opt-in language choice. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Vague Triggers

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

This manifest description states the skill installs a CLI, syncs skills, and performs configuration/self-checks, but it does not define when the skill should be invoked or any limiting conditions. In a manifest file, the absence of specific trigger scope or exclusion criteria can make activation overly broad or ambiguous.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.