元谨 yotta-anti-shallow

• Outcome: Review
• Latest audit: Sep 8, 2026 · 4:01 PM UTC
• Version: 1.4.0

Overview

This is a disclosed quality-control skill, but it broadly and persistently changes agent behavior and includes installers that can write across many agent skill directories.

Install only if you want this skill to persistently shape agent behavior on complex tasks. Prefer a pinned package version, avoid sudo/admin execution, use --agent or a carefully checked --dir instead of global mode, and uninstall it if the extra analysis and confirmation steps start appearing where you do not want them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:20
• Finding: Automatic and Partially Non-Disableable Agent Instruction Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-22, 36-42, 84-87, 105, 259-263, 283-313` **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: High ### Complete Code Snippet ```text [ROLE] identity: "rigorous_executor" not: "yes_sayer" priority: correctness > speed > completeness ``` ```text This rule has two activation methods, and either one takes effect: 1. Explicit activation: the user expresses an intent for deep analysis, rigor, root-cause analysis, or similar behavior. 2. Automatic application: the task itself reaches L3 complexity or above. ``` ```text - L3 / L4, or any destructive or irreversible operation: first output a four-element analysis report → wait for user confirmation → begin execution only after confirmation. ``` ```text F001 and R005 are non-disableable baseline rules even if the user says to exempt the rules. ``` ```text Hard baseline rules cannot be overridden: - F001: when information is insufficient, the agent must say it is uncertain - F008: the agent must not claim completion without verification - R005: when the user says "stop," the agent must stop and re-analyze ``` ```text | Rule instruction vs non-rule instruction | | Rule instructions take priority when the user says to enable the rules | ``` ### Technical Analysis The Skill is presented as a quality-discipline document, but it does more than offer optional guidance. It automatically activates for any task it classifies as L3 or higher, changes the agent's role and priorities, inserts mandatory analysis and self-check output, and can prevent execution until an additional confirmation is received. It also defines some Skill-authored rules as impossible for the user to disable and establishes an internal priority rule for resolving conflicting instructions. These controls alter the host agent's session behavior and instruction hierarchy whenever the Skill is loaded. This exceeds the minimum behavior needed to ...[truncated 1813 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Make activation explicitly opt-in and require a direct user request in the current session. 2. Remove automatic activation based solely on the Skill's own L3/L4 classification. 3. Remove all claims that Skill rules are non-disableable. 4. Explicitly state that system, developer, host, and current user instructions always take precedence. 5. Treat analysis, confidence declarations, and self-check templates as optional recommendations. 6. Do not require an extra confirmation turn unless the host or user independently requires it. 7. Remove internal instruction-priority rules that attempt to arbitrate instructions outside the Skill's scope. 8. Update the README to disclose accurately that the Skill changes session workflow and may add confirmation steps. 9. Limit the Skill description to a narrow, explicit trigger so agents do not load it for unrelated tasks. ]]>

T03 · Remote Payload Retrieval and Execution

Warning

• Location: README.md:81
• Finding: Unpinned Remote npm Package Retrieval and Execution<![CDATA[ ## Vulnerability Details **File Location**: `README.md:81-93`; duplicated in `README.zh-CN.md:102-114` and documented in `CHANGELOG.md:13` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Medium ### Complete Code Snippet ```text ### Method 1: npm one-liner (recommended) # Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-anti-shallow --agent <agent-name> npx -y @yottameta/yotta-anti-shallow --dir <your-skills-dir> ``` The Chinese README contains equivalent unpinned commands: ```text npx -y @yottameta/yotta-anti-shallow --agent <agent-name> npx -y @yottameta/yotta-anti-shallow --dir <agent-skills-directory> ``` ### Technical Analysis The recommended installation command asks `npx` to resolve the package from an external registry and immediately execute its command-line entry point. No exact version or package integrity value is supplied. Consequently, the code executed by a future user is not necessarily the same code reviewed in this audit. The `-y` option enables a non-interactive installation flow, reducing the opportunity for the user to inspect the resolved package before execution. Changing the npm registry to a mirror also introduces another distribution endpoint whose synchronization and integrity must be trusted. The audited `package.json` contains no third-party runtime dependencies or lifecycle installation hooks, and the currently reviewed `bin/install.js` contains no remote payload retrieval. The risk arises from executing a mutable future registry package rather than from a confirmed malicious payload in the reviewed version. The GitHub badge links at README lines 17-19 are images and repository links, not executable downloads. The direct remote-execution concern is the unpinned `npx` installation method. ### Attack Path 1. An attacker compromises the npm publisher account, registry distribution path, or a future package release. 2. The att ...[truncated 1111 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin installation instructions to an exact audited version, for example: ```text npx @yottameta/yotta-anti-shallow@1.4.0 --agent <agent-name> ``` 2. Avoid recommending `-y`; allow users to review the package and installation prompt. 3. Publish SHA-256 checksums or signed provenance for release artifacts. 4. Recommend inspecting the exact package tarball before executing it. 5. Use npm provenance/signing controls and protect publisher accounts with strong multi-factor authentication. 6. Document the trust implications of switching to a third-party registry mirror. 7. Prefer a fixed, signed release archive for security-sensitive or managed installations. 8. Warn users not to run the installer with `sudo` or administrator privileges. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: install.sh:63
• Finding: Destination Symlink Following and Unintended File Overwrite in Installers<![CDATA[ ## Vulnerability Details **File Location**: `install.sh:63-67`; equivalent destination handling in `bin/install.js:129-158` **Vulnerability Type**: `T09: Insecure Skill Coding Practices` **Risk Level**: Medium ### Complete Code Snippet ```bash install_to() { mkdir -p "$1/$SKILL_NAME" cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/" rm -rf "$1/$SKILL_NAME/.git" echo "installed -> $1/$SKILL_NAME" } ``` The Node installer uses the same existing target without rejecting symbolic links: ```javascript function copyDir(src, dst, skip) { for (const entry of fs.readdirSync(src, { withFileTypes: true })) { if (skip.has(entry.name)) continue; const from = path.join(src, entry.name); const to = path.join(dst, entry.name); try { if (entry.isDirectory()) { fs.mkdirSync(to, { recursive: true }); copyDir(from, to, skip); } else if (entry.isFile()) { fs.copyFileSync(from, to); } } catch (err) { throw new InstallError( 'Failed to copy ' + from + ' -> ' + to + ': ' + err.message ); } } } function installTo(dest) { if (!dest || typeof dest !== 'string') { throw new UsageError('Destination directory is required'); } const target = path.resolve(dest, SKILL_NAME); assertSafeTarget(target); try { fs.mkdirSync(target, { recursive: true }); copyDir(PKG_ROOT, target, COPY_SKIP); if (!fs.existsSync(path.join(target, 'SKILL.md'))) { throw new InstallError('Installed directory is missing SKILL.md'); } } catch (err) { if (err instanceof UsageError || err instanceof InstallError) throw err; throw new InstallError('Cannot install to ' + target + ': ' + err.message); } console.log('installed -> ' + target); return target; } ``` ### Technical Analysis Both installers accept an existing destination and recursively copy package files into it. Neither installer uses `lstat` or an equivalent operation to reject a symbolic-link target or symbolic ...[truncated 2459 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Resolve and validate the canonical destination before writing. 2. Use `lstat` on the target and every existing destination path component; reject symbolic links. 3. Reject an existing target by default and require an explicit `--force` option for replacement. 4. When replacement is requested, verify that the target is a real directory owned by the current user. 5. Copy into a newly created temporary sibling directory with restrictive permissions. 6. Validate the copied contents and atomically rename the temporary directory into place. 7. Open destination files with no-follow semantics where the platform supports them. 8. Add equivalent source-directory and containment checks to `install.sh`. 9. Avoid recursive deletion through unchecked paths; validate the canonical target before removing `.git`. 10. Add tests covering: - A symlinked target directory. - Symlinked destination files. - Installation into or beneath the package source. - Existing non-directory targets. - Shared writable destination directories. 11. Explicitly warn users not to invoke either installer with elevated privileges. ]]>

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrases are common conversational language such as '仔细查', '验证', and '证明', so the skill can activate during ordinary requests that merely ask for thoroughness. In a rule skill that alters agent behavior, unintended activation can change response structure, confirmation flow, and refusal/interrupt handling in ways the user did not explicitly request.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: Automatic activation based on task 'nature' and L3+ complexity is underspecified, leaving the host agent to infer when the skill should apply. That ambiguity can produce inconsistent or overbroad activation, effectively letting a generic quality-control skill attach itself to many complex tasks and influence agent behavior without clear user consent.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The skill is designed to auto-activate on broad conditions such as any task judged L3+ or phrases like ‘深入’, ‘认真’, and similar everyday language. Overbroad activation can unpredictably override normal agent behavior, create prompt-routing confusion, and allow users or downstream prompts to trigger heavyweight control logic without precise consent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: This section reinforces activation using vague intent-based language rather than strict, testable conditions. In prompt-based skills, repeated broad triggers increase accidental invocation risk and can make the agent follow this meta-rule in contexts where it is irrelevant or conflicts with higher-priority task instructions.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The quick-command list includes generic phrases such as ‘认真点’, ‘检查一遍’, and ‘为什么会这样’, which are common in benign conversation and likely to appear unintentionally. That makes activation easy to trigger through normal dialogue, increasing the chance of behavior hijacking, prompt conflicts, or denial-of-service via forced verbose workflows.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The installer writes into a caller-controlled directory and removes a subdirectory without any confirmation, backup, or sanity checks. If the user supplies an unintended path or if environment/path assumptions are wrong, existing skill contents can be overwritten or modified silently.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: Global install mode loops over many agent-specific locations and writes to each one without an upfront warning listing the affected paths. This increases blast radius: a single command can silently alter multiple tool environments, making mistakes harder to notice and revert.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: test/install.test.js:12