元题 yotta-item

• Outcome: Pass
• Latest audit: Sep 24, 2026 · 4:39 AM UTC
• Version: 0.1.0

Overview

This appears to be a local exam-paper assembly and checking skill with a disclosed installer; the main caution is that installation writes into agent skill directories.

Install from a trusted source or pinned version when possible. Prefer --agent or --dir so you know exactly which skill directory is modified, and use -g only if you intentionally want this skill copied into every supported agent directory. The reviewed runtime is local-only, but installation can overwrite the yotta-item folder at the destination.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (25)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing agent-specific installer behaviors such as selecting agents, custom directories, global install modes, and listing install targets is unrelated to the stated exam-paper function and suggests the package can alter agent configuration state. In a skill context, behavior hidden behind an innocuous educational description increases the risk of stealthy persistence, unauthorized file placement, or supply-chain style abuse.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Providing agent-specific installer behaviors such as selecting agents, custom directories, global install modes, and listing install targets is unrelated to the stated exam-paper function and suggests the package can alter agent configuration state. In a skill context, behavior hidden behind an innocuous educational description increases the risk of stealthy persistence, unauthorized file placement, or supply-chain style abuse.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · install.sh (reported line 66)May include surrounding context.

sh

install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The README instructs users to execute an unpinned npm package with npx, which fetches the latest published version at runtime. If the package is later compromised, hijacked, or a breaking release is published, users may run attacker-controlled code during installation or execution.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This command also uses npx with an unpinned package reference, causing users to trust whatever version is current in the registry at execution time. That creates a supply-chain risk window where a malicious or tampered release could execute on the user's machine.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

L001 明确将该文档标记为“语言: 中文”，构成对语言/locale 的显式约束；按规则，若未提供用户选择或未说明这是特定区域/受众限定的文档，可能构成自然语言层面的语言政策问题。虽然同一行包含英文链接，但当前文件本身仍以中文固定呈现，未在文内说明用户可自由选择语言版本或该中文约束的适用边界。

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The README instructs users to execute npx -y @yottameta/yotta-item without pinning a specific package version. This makes installs non-reproducible and exposes users to supply-chain risk if a later package release is compromised, maliciously replaced, or simply introduces unsafe behavior; because this is an execution/install command, the README context increases practical exploitability.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second npx -y @yottameta/yotta-item example has the same issue: it fetches and executes the latest package version at runtime with no version pinning. An attacker who gains control of the package, publishing pipeline, or a future dependency chain could cause arbitrary code execution on user machines during installation.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 78% confidence

Finding

The skill declares no explicit tool scope even though it appears to rely on environment access and file reads. Missing permission boundaries can cause the agent platform to grant broader-than-necessary access, making unintended local file exposure or misuse more likely if the skill is installed or invoked in a permissive runtime.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The script enumerates numerous AI agent directories and installs itself into them, including user-level locations resolved from the home directory. Managing multi-agent installation footprints is not justified by the manifest's narrow purpose of deterministic local exam generation and checking.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · bin/install.js (reported line 25)May include surrounding context.

js

const AGENT_DIRS = {
  claude:    { label: 'Claude Code',      dirs: ['.claude/skills'] },
  cursor:    { label: 'Cursor',           dirs: ['.cursor/skills', '.agents/skills'] },
  codex:     { label: 'Codex',            dirs: ['.codex/skills'] }, // 特判：$CODEX_HOME/skills
  gemini:    { label: 'Gemini CLI',       dirs: ['.gemini/skills', '.agents/skills'] },
  goose:     { label: 'Goose',            dirs: ['.config/goose/skills', '.agents/skills'] },
  amp:       { label: 'Amp',              dirs: ['.config/agents/skills', '.agents/skills'] },

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest describes a local, deterministic exam-item selection and checking skill that does not mention installation or modifying agent configuration directories. This file creates directories and copies the package into agent/project skill locations, which is behavior materially different from the stated functional scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The installer creates and populates a target skill directory and then removes the copied .git directory via rm -rf, which is a destructive filesystem operation. Although the script prints a completion message afterward, there is no prior warning or confirmation that existing contents under the target path may be overwritten or deleted.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 124)May include surrounding context.

sh

echo "完成。"; return
  fi
  local installed=0 d
  for d in .claude/skills .cursor/skills .codex/skills .config/goose/skills .config/agents/skills .opencode/skills .codeium/windsurf/skills .workbuddy/skills .kiro/skills .traecli/skills .gemini/skills .trae-cn/skills .qwen/skills .comate/skills .codebuddy/skills .kimi/skills .agents/skills; do
    if [ -d "$d" ]; then install_to "$d"; installed=1; fi
  done
  if [ "$installed" = "0" ]; then

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The entire skill document is written only in Chinese and presents the format and validation rules without offering an alternative language or stating that the skill is intended exclusively for a Chinese-language context. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

该 markdown 文档从标题到内容均以中文固定表述报告格式，未见提供多语言选项、用户选择机制，或说明该语言限制仅适用于特定区域/合规场景。按规则，这属于自然语言层面的语言/locale 策略约束，可能对非中文用户造成不当限制。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

SQP-3 applies to all file types and covers natural-language policy violations such as forcing a specific language without user opt-in. Here, the module docstring and later CLI/help/output strings are Chinese-only, with no mechanism to select another language or document a justified locale restriction.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

技能说明强调本地、确定性、不联网等边界，并在模块文档中写明“只读本地题库 / 双向细目表 / 试卷”。然而 cmd_template 会创建输出目录并写入 bank.json、blueprint.json、paper.json 三个文件，这超出了“只读”表述的自然语义范围。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file uses Chinese throughout, including the title and all release notes, with no indication that the skill is region-specific or that alternative languages are available. Under the policy rule for language or locale constraints, forcing a single language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Line L41 states that validation failures must return a Chinese reason, which imposes a fixed language requirement in natural-language behavior. Under the policy, locale or language constraints should either be optional for the user or clearly justified as region-specific; this document does not provide such justification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.