元伴 yotta-partner

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 5:54 PM UTC
• Version: 0.2.4

Overview

This skill provides a clearly disclosed collaboration workflow with approval checks, local progress records, and ordinary installation risks.

Expect automatic workflow checks and disclosed local progress notes. Choose a specific installation destination, back up any customized existing copy, and review the scope before using global installation. Prefer reviewed local files or an exact verified npm release over the unpinned examples. Approve permanent-memory registration and sensitive recording explicitly. The scanner's installer gaps were investigated directly; this assessment does not verify future downloaded releases or host permission enforcement.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 33)May include surrounding context.

md

## What it is

People often fail with AI not because the AI is weak, but because the collaboration is sloppy:
no context, no plan, no verification, no memory across sessions. Yuanban turns that around with a
**repeatable collaboration protocol**:

1. **Context brief** — background, goal, constraints, acceptance criteria.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

md

| **Executable, not inspirational** | A fixed protocol unit: context brief, plan gate, milestones, verification, handover |
| **Works across agents** | Platform-neutral Markdown; no runtime, daemon or network required |
| **Lowest common layer** | Cross-agent minimum bar; any side keeps stricter local rules and the stricter one wins |
| **Fixes the common failure modes** | Missing context, direct action without approval, unverified output, lost session state |
| **Verifiable, not theatrical** | Acceptance criteria are checkable lists; unverified claims are labeled; evidence is real output |
| **Self-correcting on exceptions** | Detects common failure signals (acting without a plan, claiming completion without evidence, losing state) and stops to fix them with a one-line visible note |
| **Focuses on the human** | The user owns direction, judgment and final review; the AI handles execution and memory |

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-partner --agent <agent-name>   # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-partner --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended installation command executes an unpinned npm package with automatic confirmation. Although this is an installer rather than an MCP server, a compromised future release could execute with the user's privileges and modify agent skill directories.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The custom-directory installation example executes an unpinned npm release without an interactive package confirmation. Selecting a destination does not constrain the downloaded program's privileges, so a compromised release could access other user-readable or writable resources.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended command automatically executes an npm package without fixing the release version. This is not an MCP server, but a compromised future installer release could still execute arbitrary code with the user's privileges and alter persistent agent skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The custom-directory example retrieves and executes an unpinned npm package with automatic confirmation. The directory argument controls the intended installation destination, not the executable's access to the user's system, leaving a supply-chain execution risk.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The usage comment recommends executing an unpinned npm installer for a user-level agent directory. The comment does not execute itself, but following it could run a compromised future release with the user's privileges; the MCP-server label is inaccurate.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The custom-path usage example executes whichever npm release is resolved rather than a reviewed version. Although the example is a comment, users following it expose their account to compromised package code, and the destination argument does not sandbox execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The global-install example recommends an unpinned executable npm package. If followed after a release compromise, it could execute attacker code with user privileges, while the intended global operation also spans multiple persistent agent skill locations.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The default-install example executes an unpinned package before performing project-directory detection. It is documentation rather than an active download in this script, but following it could execute a compromised release and persist malicious instructions in project skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Even the '--list' example invokes an unpinned npm executable before any listing behavior occurs. The supplied installer only prints directory mappings for this option, but a compromised future release need not honor that behavior and could execute arbitrary code.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The '--dry-run' example still downloads and executes an unpinned npm program. Although the supplied implementation avoids installation writes in dry-run mode, that flag cannot protect against a compromised package that ignores it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The version-query example executes an unpinned npm package to obtain its version. A compromised release can run code before or instead of returning version information, so an informational option does not eliminate the supply-chain risk.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-partner'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The help example invokes an unpinned npm executable with automatic confirmation. The current script prints help, but a compromised resolved release could execute arbitrary code regardless of the '--help' argument.

Content

No source excerpt is available for this finding.