Security audit
Security checks for vulnerabilities and agentic risk
Review is recommended because sensitive information can remain in the shared local knowledge base, and setup automatically changes lasting agent instructions and settings.
Use only sanitized knowledge and independently review entries before sharing them across agents or projects; draft and verified labels do not guarantee confidentiality. Approve global memory and MCP changes separately, and record how to undo them. Pin installation to a reviewed release and back up before migration. The scanner's four partial-file gaps were investigated directly; this was a static review, and actual host permission enforcement remains unverified. No artifact-backed evidence of intentional exfiltration or a hidden malicious payload was found.
This source explicitly permits overriding sensitive-content review findings with --force --note despite promising that sensitive information never enters the shared KB. That documented exception undermines the confidentiality boundary, although the additional claims about unchecked updates and metadata scanning cannot be independently established from this source alone.
The documented sensitive-content override contradicts the stated exclusion of secrets from a cross-agent knowledge base and can permit their broader reuse. Writing project-specific knowledge into project files is explicitly supported here, so the promote-to-project-file claim is not independently evidence of a vulnerability; draft implementation details are also not shown in this source.
The documented ability to force approval of sensitive findings undermines the declared confidentiality boundary regardless of which interface exposes it. The specific entry.review operation and confirmation-string behavior are not shown here, so that interface-specific portion remains unverified.
The source documents a sensitive-review force override and presents MCP as exposing the same KB write operations. This supports the underlying policy-bypass concern in a shared knowledge base, but the exact MCP parameter forwarding alleged by the finding is not visible in this source.
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
## Claude Code
把 hooks/claude-settings.json 内容合并到 ~/.claude/settings.json（或项目 .claude/settings.json），
并把 PATH_TO_SKILL 替换为技能实际路径。
## Codex
Skill reads from agent configuration directories (.claude/, .codex/, .gemini/). These directories may contain API keys, personal settings, and other credentials that the skill has no legitimate need to access.
## Codex
把 hooks/codex-settings.json 内容合并到 ~/.codex/settings.json（或项目 .codex/settings.json），
并把 PATH_TO_SKILL 替换为技能实际路径。
## OpenClaw
add_entry persists drafts without sensitive scanning, while review_entry allows detected sensitive content to become verified when force and a note are supplied. Additionally, review omits evidence from its scan, and update_entry can modify verified entries without rescanning or resetting their status, allowing secrets into shared storage and approved content.
The add workflow persists an entry through yotta_kb.add_entry before scanning its content, and detected sensitive information produces a warning rather than preventing storage or removing it. Drafts are accessible through management list/show workflows, making this particularly dangerous for a cross-agent knowledge base; the advertised force-approval path further weakens the boundary, although its implementation is delegated to an unprovided module.
The review handler forwards caller-controlled force to the review implementation, and its tool description explicitly advertises overriding sensitive-content blocking with a note. This exposes the exception to the same agent performing ordinary knowledge-base operations, allowing detected sensitive material to become verified and discoverable across agents despite the stated prohibition; an audit record does not prevent that exposure.
The review action explicitly allows sensitive-content checks to be overridden using force=true and a fixed confirmation string, contrary to the skill's stated prohibition on placing sensitive information in the knowledge base. Because this knowledge base is intended for reuse across agents and projects, approving sensitive entries can expose secrets or personal information beyond their original context; however, this requires an authenticated local session and is not an unauthenticated remote bypass. Confirmation and auditing establish deliberate action but do not prevent disclosure.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
The skill activates "before starting work" and on standalone terms such as "kb", "经验" (experience), and "learnings", without requiring a knowledge-base intent. These conditions can match unrelated tasks or ordinary discussion, and no exclusions distinguish incidental mentions from invocation requests.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-learn install --agent <agent-name> # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-learn install --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)
# Legacy form (equivalent): npx -y @yottameta/yotta-learn --agent <agent-name>
The recommended installation command executes a registry-selected package version without pinning it, and -y suppresses the installation prompt. A compromised publisher or malicious future release could execute code with the invoking user's privileges and install persistent agent instructions; this is an installer supply-chain weakness, not specifically an MCP launch configuration.
This installation alternative executes an unpinned npm package before installing into the selected skills directory. A compromised newly selected release could run arbitrary code as the user and persist malicious skill content; choosing a destination directory does not constrain the package's execution privileges.
Although shown as a comment, this is explicitly documented as an equivalent legacy installation command for users to run. It retains the same unpinned package execution risk: a malicious future release could execute with user privileges and alter installed skills.
The upgrade instructions explicitly recommend executing the latest unpinned package and replacing installed skill files. This lets a compromised future release cross directly into local code execution and persistent agent behavior without a version-specific review.
The skill automatically activates for standalone terms such as “经验” (experience), “踩坑” (pitfalls), and “learnings,” which can occur in ordinary discussion without a request to use a knowledge base. Conditions such as starting work or encountering a non-obvious problem further broaden activation, with no exclusions distinguishing incidental mentions from intended invocation.
The recommended npm installation command executes an unspecified package version, with -y suppressing the installation prompt. A compromised future release could execute code under the user's account and persist malicious agent instructions; the weakness concerns installer supply-chain control rather than an MCP server configuration.
This directory-targeted installation command still executes an unpinned package with the invoking user's privileges. A malicious newly selected release could modify local files or install persistent malicious skill content; the destination argument does not sandbox execution.
The commented legacy command is presented as a supported equivalent that readers can execute. Its lack of a version pin permits a compromised future package release to execute with user privileges and install altered skill content.
The upgrade guidance recommends fetching the latest package without pinning and overwriting the existing skill. A compromised release can therefore gain local code execution and replace persistent agent instructions through the ordinary upgrade process.
Without declared permissions the skill's intent is opaque and cannot be validated.
The trigger description includes broad words such as “经验” (experience) and “沉淀” (consolidate), as well as routine events such as starting work, command failures, and user corrections. These can activate the skill during unrelated tasks; the stated boundaries govern where information is stored rather than excluding unintended invocations.