元谨 yotta-anti-shallow

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 5:38 PM UTC
• Version: 1.4.4

Overview

The skill provides disclosed answer-quality rules and optional installers, with no evidence of hidden access or harmful behavior.

Expect extra analysis, confirmations, and self-check reports on complex tasks. Prefer reviewed files or an exact package version, select one agent or directory, and preview installation with --dry-run. Back up local skill edits before reinstalling; -g installs across multiple agents. Manual review covered both partially analyzed installers, but they were not executed and future npm releases were not verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

<h1 align="center">yotta-anti-shallow · 元谨 (Yuanjin)</h1>

<p align="center">A general-purpose anti-shallow AI output rules engine: <b>analyze first · then execute · self-check after</b>, curbing surface-level output. For any scenario that needs correctness and rigor — development, bug fixing, data analysis, architecture design, documentation, open-ended Q&amp;A.</p>
<p align="center">Activates automatically when it detects intent for deep analysis / end-to-end verification / root-cause tracing / rigorous execution / detailed checking; also applies automatically to any task at L3 (complex) and above — <b>judged by task nature, not keyword luck</b>.</p>
<p align="center">Pure rule text, zero dependencies, no injection, no execution takeover; install once, works across 78+ agents such as Claude Code / Codex / Cursor / OpenCode.</p>

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json

{
  "name": "@yottameta/yotta-anti-shallow",
  "version": "1.4.4",
  "description": "Anti-shallow AI output rules engine: force analyze-first / execute-after / self-check, curbing superficial output. Activates on intent for deep analysis, end-to-end verification, root-cause tracing, rigorous execution, meticulous checking; also applies automatically to any task at L3 (complex) and above. Boundaries: quality discipline only; no code execution, no external tools, not a replacement for tests or human review.",
  "license": "MIT",
  "keywords": [
    "agent-skills",

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk's primary function is installation and filesystem maintenance, not detecting complex requests or applying reasoning-quality rules. Although installation can support distributing a skill, these persistent write and cleanup operations are material capabilities absent from the description and outside its stated non-executing boundary. The code includes target-validation and symlink safeguards, and no network access or subprocess execution is evident; the mismatch does not by itself establish malicious behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk performs installation and maintenance rather than the declared analysis-quality discipline. Ordinary installer details can support a skill, but this description explicitly presents a non-executing rule and does not disclose its filesystem-writing and cleanup behavior. Those material side effects exceed that boundary. The script includes target and symlink safeguards, and no network activity or exfiltration is evident; the mismatch concerns undisclosed installation capabilities, not evidence of malicious intent.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 34)May include surrounding context.

md

- **Graded by complexity to avoid formalistic burden** — L1 simple tasks answer directly; L2 brief analysis then act; L3 full analysis + user confirmation; L4 break into multiple L3s.
- **Transparency assurance** — speculative conclusions must declare confidence (certain / high / medium / low / guess); pseudo-certainty is forbidden.
- **Self-check on completion** — proactively output a self-check report at task end, surfacing doubts and uncovered points.
- **Bottom line cannot be turned off** — when information is insufficient you must say so; never fake completion without verification; if the user interrupts, redo it — these stay in effect even when “rules off” is said.

## Core advantages

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 87)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-anti-shallow --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-anti-shallow --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The recommended installation command uses npx -y without a package version, allowing a mutable registry release to execute with the installing user's privileges without an installation confirmation prompt. This is an installer rather than an MCP server, but a compromised future release could modify user-level agent skills or other accessible files.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The custom-directory installation example executes an unpinned npm package through npx -y. The destination argument does not sandbox the executable, so a compromised release could act beyond the requested skills directory with the user's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The upgrade guidance explicitly recommends rerunning an unpinned command to obtain the latest release. This executes newly published code without a version-review checkpoint, creating a supply-chain exposure if the package or publishing account is compromised.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The recommended npx -y command executes a package selected without an exact version pin. Although not an MCP server, this installer exposes the installing user's environment to a compromised or malicious future registry release.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This alternative installation command also executes an unpinned registry package without an installation confirmation prompt. Specifying a target directory limits the intended installation location but does not restrict what a compromised executable can access.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The upgrade instructions recommend executing whichever package release is current rather than an explicitly reviewed version. A compromised publisher or registry release could consequently execute code and replace persistent agent skill content during an otherwise legitimate upgrade.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-anti-shallow'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Automatic activation for any task at 'L3 (complex) and above' uses an undefined complexity threshold.

Low

• Category: Trigger Abuse
• Confidence: 95% confidence

Finding

The description automatically activates the skill for any task classified as L3 or higher, but does not define that classification or provide concrete activation criteria. This leaves activation to subjective interpretation and could apply the skill to unrelated tasks merely considered complex.

Content

No source excerpt is available for this finding.

Automatic activation is triggered by broad, everyday requests for rigor or seriousness.

Low

• Category: Trigger Abuse
• Confidence: 93% confidence

Finding

The activation condition includes generic terms such as “深入” (in-depth), “严谨” (rigorous), and “认真” (serious/careful), without limiting them to a particular domain or explicit invocation. These ordinary requests for answer quality can unintentionally activate the skill; the later exemption from the full workflow for simple questions does not explicitly exclude skill activation.

Content

No source excerpt is available for this finding.