Security audit

元真 yotta-humanize

Security checks for vulnerabilities and agentic risk

Overview

Review recommended: automatic rewrites can change factual claims and quotations despite explicit promises to preserve them.

Prefer analysis or suggestions, and compare proposed edits with the original before saving. Do not rely on the promise that automatic rewriting preserves facts, percentages, quotations, or attribution. Install only into intended agents and prefer reviewed local files or a pinned installer version. All supplied artifact files and both scanner coverage gaps were inspected; remote npm contents were not verified.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (22)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The supplied executable's primary behavior is filesystem installation and maintenance, not Chinese-text scoring or rewriting. Although installation can support the broader skill, this is a standalone installer with persistent filesystem effects rather than an implementation detail of the declared text-processing workflow. Those capabilities are not represented in the description. The chunk contains no text analysis, AI-flavor scoring, or rewriting logic. No network access or model invocation is shown, and this assessment does not establish what other package files implement.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The supplied code’s primary operation is filesystem installation and maintenance, rather than processing existing Chinese text. Although an installer can support the broader skill, this chunk is entirely a deployment tool with persistent filesystem effects not represented by the declared text-only purpose. Its path and symlink checks constrain those effects but do not change its purpose. No network access, model invocation, or exfiltration is evident. This assessment is limited to the supplied installer and does not establish what the installed skill files do.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The reported automatic transformations change quantitative certainty and remove evidence attribution, contradicting the manifest's explicit fact-preservation and suggestion-only boundaries. In reports or technical material, users could accept materially altered claims as merely stylistic edits; a fix list reduces but does not eliminate this integrity risk.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 85% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · README.md (reported line 131)May include surrounding context.
text
# Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-humanize --agent <agent-name> # install to the agent's default user-level skills dir npx -y @yottameta/yotta-humanize --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The recommended installation command executes an npm package without selecting a reviewed version, and -y suppresses the installation prompt. Although this is not an MCP server, a compromised publisher or malicious future release could execute code with the user's privileges and install persistent agent instructions.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The custom-directory installation example executes an unpinned remote npm package with automatic confirmation. A compromised future release could run arbitrary code under the invoking account; the destination argument does not sandbox that execution.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: This recommended command runs an unpinned npm installer and automatically accepts installation. While not an MCP configuration, it permits a compromised or unexpectedly changed release to execute with the user's privileges and modify agent skill files.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The custom-path example downloads and executes whichever package release the registry currently resolves, rather than a reviewed version. The selected filesystem destination does not prevent malicious installer code from accessing other resources available to the user.
Content: No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read.

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 70% confidence
Finding: npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Content: No source excerpt is available for this finding.

Automatic activation includes generic text editing and polishing without requiring an AI-style detection or removal request.

Medium

Category: Trigger Abuse
Confidence: 96% confidence
Finding: The condition “当你编辑/润色文本” activates the skill whenever text is edited or polished, overlapping with ordinary proofreading and revision requests. Although the line also provides domain-specific triggers, it does not constrain this broader condition or exclude unrelated editing tasks.
Content: No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-humanize'.

Medium

Category: MCP Rug Pull
Confidence: 94% confidence
Finding: The troubleshooting guidance recommends executing an unpinned npm installer with automatic confirmation. This creates a supply-chain execution risk if a later release or publisher account is compromised, even though the package is an installer rather than an MCP server.
Content: No source excerpt is available for this finding.

Automatic rewrite mappings change factual certainty and quantitative claims despite the manifest's preservation boundary.

Medium

Category: Excessive Agency
Confidence: 99% confidence
Finding: HZ-06 places changes such as “百分之百” to “基本” and “必然导致” to “往往导致” in automatic fix mappings, altering quantities and causal certainty rather than just style. These context-free transformations can corrupt legitimate factual statements despite the advertised preservation boundary, especially in technical, legal, or analytical documents.
Content: No source excerpt is available for this finding.