Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed local developer-tool MCP with explicit gates for writes and command execution; the main cautions are broad local MCP diagnostics and unpinned npx examples, not hidden malicious behavior.
Install or run the exact reviewed version, e.g. pin @yottameta/yotta-dev-mcp@0.2.0 rather than using a floating npx command. Only enable allow_execute=true or apply=true when you intend local commands or writes, and use explicit mcp_doctor paths if you do not want it to inspect default user-level skill and MCP config locations.
The README text does mention mcp_doctor, but the metadata summary/description and the declared 18-tool list appear inconsistent, and the static finding suggests access to user home/config locations outside the target repository. Accessing user-level config and skill directories can expose unrelated sensitive information and expands the trust boundary beyond a normal repo-analysis tool.
The README text does mention mcp_doctor, but the metadata summary/description and the declared 18-tool list appear inconsistent, and the static finding suggests access to user home/config locations outside the target repository. Accessing user-level config and skill directories can expose unrelated sensitive information and expands the trust boundary beyond a normal repo-analysis tool.
The README text does mention mcp_doctor, but the metadata summary/description and the declared 18-tool list appear inconsistent, and the static finding suggests access to user home/config locations outside the target repository. Accessing user-level config and skill directories can expose unrelated sensitive information and expands the trust boundary beyond a normal repo-analysis tool.
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.
def _child_env():
env = os.environ.copy()
env["PYTHONIOENCODING"] = "utf-8"
env["NO_COLOR"] = "1"
env["FORCE_COLOR"] = "0"
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
"applied": bool(apply),
"preview": preview,
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
record("missing-contract", "no architecture contract", "UNKNOWN",
observed, observed == "UNKNOWN", detail)
write("secret.env", "TOKEN=abcdefghijklmnopqrstuvwxyz123456\n")
try:
from dev_engine import scan_secrets
observed = len(scan_secrets(str(root))["findings"])
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| `compress_output` | Compress long logs while keeping errors and head/tail context. |
| `review_code` | Apply deterministic review rules with file, line and evidence. |
| `review_diff` | Review only added lines in a unified diff. |
| `mcp_doctor` | Inspect installed skills and MCP JSON configuration files. |
| `scan_secrets` | Scan for credentials and high-entropy tokens with redacted evidence. |
| `scan_dependencies` | Check manifests, lockfiles, insecure sources and typosquat suspicion. |
| `check_publish_readiness` | Check version alignment, release files and package metadata. |
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
| `compress_output` | Compress long logs while keeping errors and head/tail context. |
| `review_code` | Apply deterministic review rules with file, line and evidence. |
| `review_diff` | Review only added lines in a unified diff. |
| `mcp_doctor` | Inspect installed skills and MCP JSON configuration files. |
| `scan_secrets` | Scan for credentials and high-entropy tokens with redacted evidence. |
| `scan_dependencies` | Check manifests, lockfiles, insecure sources and typosquat suspicion. |
| `check_publish_readiness` | Check version alignment, release files and package metadata. |
The README instructs users to run npx -y @yottameta/yotta-dev-mcp without pinning an exact package version. That causes execution of whatever version is current in the registry at install/run time, creating a supply-chain risk where a compromised or maliciously updated package could be fetched and executed by users.
This installation command uses npx with an unpinned package reference, so users may execute a different package version than the one reviewed in the repository. If the npm package is hijacked, replaced, or later publishes unsafe code, the command can lead to arbitrary code execution on the user's machine.
This example also fetches and runs the latest package version implicitly. In the context of an MCP server/skill installer, that is especially sensitive because the package may write files into skill directories and influence developer tooling, amplifying the impact of a compromised release.
Using npx -y @yottameta/yotta-dev-mcp --list without a version pin leaves users exposed to unexpected package changes at execution time. Even though --list sounds low risk, the package itself still has to be downloaded and run first, so compromise of the published artifact can still result in code execution.
The README instructs users to run the package via npx without pinning an exact version, which makes execution depend on whatever version is current in the registry at install time. If the package is later compromised, a malicious version is published, or a breaking release appears, users may unknowingly execute unreviewed code on their systems.
This command uses npx with an unpinned package name, so the actual code executed is not fixed and can change over time. In a developer-tooling context, that is risky because users are being instructed to fetch and run code directly, potentially exposing their environment to a compromised or unexpected release.
The documented installation path executes a package from the registry without version pinning, which introduces supply-chain risk and reduces reproducibility. Because this is a tool intended for local development environments, exploitation could lead to arbitrary code execution under the user's account if the package distribution is tampered with.
Using npx on an unpinned package in a --list example still causes users to trust whatever version resolves at runtime. That creates a preventable supply-chain exposure, especially since the package is positioned as an MCP server/skill installer that may be run by users with access to source code and local credentials.
The README states that the skill does not execute code, but elsewhere documents features that do execute whitelisted checks or adapters when explicit flags are enabled. This inconsistency can mislead users and reviewers about the trust boundary, causing them to underestimate execution risk and enable the tool in contexts where command execution is not acceptable.
The skill advertises multiple potentially sensitive capabilities in practice (file read/write, shell, env, possible network) but does not declare an explicit tool scope such as permissions or allowed-tools. That weakens user and platform visibility into what the skill may access, increasing the chance of over-privileged execution or unsafe trust assumptions.
Using npx -y @yottameta/yotta-dev-mcp without a pinned version allows whatever package version is current at execution time to be fetched and run. This creates a supply-chain risk: a compromised publisher account, malicious new release, or unexpected breaking change could execute arbitrary code on the user's machine.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
def _run_process(argv, cwd, timeout):
"""Run one fixed argv without a shell. Tests replace this boundary."""
return subprocess.run(
[str(item) for item in argv],
cwd=str(cwd),
capture_output=True,
The function raises user-facing ValueError messages in Chinese (路径不存在, 需要目录) with no indication that language selection is configurable or optional. This creates a locale policy concern because the skill file imposes a specific language on users regardless of their preferences.
This Python file includes multiple hard-coded Chinese messages in exceptions and generated content, such as "路径不存在" and "repo_map 需要目录". Because the file is code, these strings define user-visible behavior and impose a specific language without offering a locale choice, which matches the language/locale policy violation criteria.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
command = ["git", "-C", str(path), "diff", "--no-ext-diff", "--unified=0"]
if base:
command.append(str(base))
proc = subprocess.run(command, capture_output=True, text=True)
if proc.returncode != 0:
raise ValueError("git diff 失败: %s" % (proc.stderr.strip() or proc.stdout.strip()))
diff_text = proc.stdout
The helper defaults (_default_skill_dirs, _default_config_paths) cause the tool to probe broad user configuration locations such as ~/.codex, ~/.claude, and ~/.cursor. In a skill advertised as offline, deterministic development tooling, this hidden cross-directory inspection increases privacy risk and breaks least-privilege expectations.
mcp_doctor enumerates user-level skill directories and MCP configuration files under the home directory, which expands the tool's access beyond the repository-focused functionality described in the skill metadata. That creates an information disclosure surface by reading unrelated local configuration and installed skill metadata that a caller may not expect this skill to inspect.
Detected: suspicious.dangerous_exec