元史 yotta-logs

• Outcome: Pass
• Latest audit: Oct 2, 2026 · 3:16 AM UTC
• Version: 0.3.3

Overview

This skill is a disclosed local log-search tool; it reads sensitive local agent history by design, but I did not find hidden upload, destructive runtime behavior, or deceptive instructions.

Install only if you want an agent to search local conversation and memory logs. Prefer using --dir, --source, --kind, or --format to limit the scope, keep default redaction on, and avoid --no-redact unless you are sure the output will not expose secrets or private history.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (47)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A skill presented as a historical log retriever but behaving as an installer or packaging utility creates a trust-boundary failure: operators expect passive inspection, but the code may modify multiple agent-specific directories and clean up existing files. In the context of a cross-agent log skill, this is more dangerous because it already has a plausible reason to enumerate local agent paths, making unauthorized persistence or environment tampering easier to hide.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A skill presented as a historical log retriever but behaving as an installer or packaging utility creates a trust-boundary failure: operators expect passive inspection, but the code may modify multiple agent-specific directories and clean up existing files. In the context of a cross-agent log skill, this is more dangerous because it already has a plausible reason to enumerate local agent paths, making unauthorized persistence or environment tampering easier to hide.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 43)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 48)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 52)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 58)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md

python3 scripts/yotta_logs.py locate

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The manifest explicitly states '不修改、不删除', but this function removes prior installation residues using rmSync and unlinkSync within existing target directories. Even if limited to installation artifacts, this is still deletion behavior that contradicts the skill's stated no-modify/no-delete scope.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a skill whose boundary is limited to reading local conversation/memory logs and explicitly says it does not modify or delete. This installer creates directories, copies files into agent skill locations, and also invokes cleanup of prior installations, which is materially different from the claimed read-only log retrieval behavior.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation text is broad enough to trigger on many ordinary references to prior discussion, which can cause the skill to search local historical logs more often than users may reasonably expect. In a log-retrieval skill, over-broad activation increases the chance of unnecessary access to sensitive local conversation and memory data, even if the tool is nominally read-only and redacts output by default.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 114)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-logs@0.3.3 --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-logs@0.3.3 --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README says the skill auto-activates whenever users mention prior conversations, parent sessions, or historical context. That trigger scope is broad enough to fire on many ordinary prompts and can cause the agent to read local conversation or memory logs without a sufficiently specific user intent, increasing privacy and least-privilege risk. In this skill context, the danger is somewhat reduced because the claimed scope is local and read-only, but the data involved is still highly sensitive.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The documentation emphasizes convenience and safety features, but it does not prominently warn users that the skill may scan and read large sets of local historical session and memory files that can contain sensitive prompts, secrets, personal data, or internal reasoning artifacts. Insufficient disclosure can lead to uninformed use and unintended exposure of private local data in agent context or outputs, even with default redaction. The skill context makes this materially relevant because its core purpose is broad local log retrieval.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 115)May include surrounding context.

text

# 可选国内加速：npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-logs@0.3.3 --agent <智能体名称>      # 装到指定智能体默认用户级技能目录
npx -y @yottameta/yotta-logs@0.3.3 --dir <智能体的技能目录>  # 指到技能目录本身（如 ~/.codex/skills）

• --agent <name> 自动装到该智能体默认用户级目录；--list 可查看各智能体默认目录。

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.zh-CN.md (reported line 115)May include surrounding context.

text

# 可选国内加速:npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-logs@0.3.3 --agent <智能体名称>      # 装到指定智能体默认用户级技能目录
npx -y @yottameta/yotta-logs@0.3.3 --dir <智能体的技能目录>  # 指到技能目录本身(如 ~/.codex/skills)

• --agent <name> 自动装到该智能体默认用户级目录;--list 可查看各智能体默认目录。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares broad local log-reading behavior but does not explicitly declare tool scope or permissions, even though its functionality clearly requires file reads and possibly environment access for path discovery. Missing scope declarations reduce transparency and make it harder for the host agent or user to constrain what the skill may inspect, which is risky for a log-retrieval skill that may touch sensitive local history and memory files.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This code file contains natural-language instructions and output that force a specific language/locale for all users. The policy allows locale constraints only when users are given a choice or the regional limitation is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.