Security audit

元质 yotta-code-quality

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent code-review skill with disclosed installers and optional integrations; the scanner alerts mainly reflect installer behavior and safety-hook examples rather than hidden malicious behavior.

Before installing, prefer a pinned npm version or a reviewed tarball if supply-chain repeatability matters. Use --agent or --dir for one target rather than -g unless you intentionally want it in many agents, and only install the optional hooks, history tracking, or AGENTS template if you want persistent review behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (51)

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 138)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.zh-CN.md (reported line 151)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 138)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 70% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.zh-CN.md (reported line 151)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.md (reported line 138)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 90% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · README.zh-CN.md (reported line 151)May include surrounding context.
md
│ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.md (reported line 138)May include surrounding context.
�─ editorial-extensions.md # R7 / UX1 / anti-over-flagging │ ├── source-coverage.md # book matrix (deep mode) │ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner └── LICENSE # MIT

text
## Install Pick any of the four methods below; the order is the recommended priority. Skill files always come from **npm** (GitHub can be slow without a proxy; npm supports mirrors). ### Method 1: npm one-liner (recommended) ```text # Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · README.zh-CN.md (reported line 151)May include surrounding context.
�─ editorial-extensions.md # R7 / UX1 / anti-over-flagging │ ├── source-coverage.md # book matrix (deep mode) │ ├── pr-review-guide.md # 7-step PR review │ ├── examples.md # tone / scoring calibration │ ├── AGENTS-template.md # optional: drop into a repo as AGENTS.md │ └── hooks.json # optional: PreToolUse hooks for rm -rf / git push --force ├── bin/install.js # npx cross-platform installer ├── install.sh # one-shot install to 17 agent families ├── assets/banner.png # brand banner └── LICENSE # MIT

text
## Install Pick any of the four methods below; the order is the recommended priority. Skill files always come from **npm** (GitHub can be slow without a proxy; npm supports mirrors). ### Method 1: npm one-liner (recommended) ```text # Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description says this skill reviews code quality and emits structured review findings with a Health Score based on code/PR input. The supplied code does none of that. Its primary purpose is installation/deployment of the skill package: it parses CLI flags, determines install destinations for various agents, copies package contents, removes residue, checks for SKILL.md, and reports install status. These are materially different behaviors and involve filesystem modification capabilities not reflected in the declared purpose. This is not a mere implementation detail of a reviewer; it is an installer with a different primary function.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: The declared description is for a code-reviewing skill that inspects code quality and produces structured review findings. The supplied code does not review code, parse diffs, score health, detect risks, or implement any trigger logic related to code review. Instead, it is an installation utility whose primary purpose is to copy the skill into agent-specific directories, optionally remove residual files, and manage install targets. This is a materially different purpose and includes undeclared filesystem-modifying capabilities. While installer scripts can be related to packaging, the description is specifically about runtime review behavior, not installation behavior, so this is a clear description-behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.
md
| **Quick** | pasted function / < ~50-line diff / “扫一眼” | This `SKILL.md` + cheat-sheet below | `decay-risks.md` only for a borderline Critical |

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · references/pr-review-guide.md (reported line 79)May include surrounding context.
md
- Test names express scenario and expected outcome? Assertions have message strings? - If vague/no messages → 🟢 Suggestion: Test Obscurity (Meszaros — xUnit Test Patterns, Assertion Roulette p.224). **Output rule:** If all three signals clean → no Test findings, proceed to report. If findings exist → add them in Iron Law format, labeled with the test risk name. Note in Summary: "Consider a full test-quality review for systemic test problems."

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 153)May include surrounding context.
text
# Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-code-quality --agent <agent-name> # install to the agent's default user-level skills dir npx -y @yottameta/yotta-code-quality --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: The README instructs users to run npx -y @yottameta/yotta-code-quality without pinning an exact package version. That creates a supply-chain risk: users may unknowingly execute a newly published, compromised, or typosquatted package version at install time.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 97% confidence
Finding: This install example again uses npx with an unpinned package version, so execution depends on whatever version the registry serves at that moment. In a compromise scenario, the installer could run arbitrary code on the user's machine during installation.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrases are broad enough that normal chat like 'review this PR' or 'any issues' may invoke the skill unexpectedly. In agent environments, overbroad activation can expand file access and cause unintended review or fix workflows to run when the user did not clearly intend to use this skill.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 96% confidence
Finding: The upgrade instructions tell users to rerun the same unpinned npx install command, which repeats the same supply-chain exposure on every upgrade. Attackers who compromise the package or dependency path later could gain code execution during a routine update.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documented trigger phrases are broad enough to overlap with ordinary conversation, which can cause the skill to activate outside the user's intended scope. For a review skill, unexpected activation can expose unrelated repository content, consume context, or steer an agent into reading and analyzing files the user did not mean to submit.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README recommends executing an unpinned package with npx -y, which fetches and runs the latest published version at install time. If the package is compromised, a malicious version is published, or the registry is poisoned, users may execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.zh-CN.md (reported line 167)May include surrounding context.
text
# 可选国内加速：npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-code-quality --agent <智能体名称> # 装到指定智能体默认用户级技能目录 npx -y @yottameta/yotta-code-quality --dir <智能体的技能目录> # 指到技能目录本身（如 ~/.codex/skills）

--agent <name> 自动装到该智能体默认用户级目录；--list 可查看各智能体默认目录。

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.zh-CN.md (reported line 167)May include surrounding context.
text
# 可选国内加速:npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-code-quality --agent <智能体名称> # 装到指定智能体默认用户级技能目录 npx -y @yottameta/yotta-code-quality --dir <智能体的技能目录> # 指到技能目录本身(如 ~/.codex/skills)

--agent <name> 自动装到该智能体默认用户级目录;--list 可查看各智能体默认目录。

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: This line again instructs users to run an unpinned npx package, creating a supply-chain execution path where the fetched code can change over time without review. In an agent-skill installer context, that code may also write into agent skill directories, increasing trust impact.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The usage section repeats natural-language triggers like 'review this PR' and '发版前扫一眼' without a strong gating mechanism, which can lead to accidental invocation. In agent ecosystems, broad trigger matching can unintentionally cause file reads, configuration loading, and analysis behaviors that exceed user intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.