Security audit
Security checks for vulnerabilities and agentic risk
This appears to be a local formatting skill, but it asks to persistently change agent configuration and memory while applying broadly to future AI outputs.
Install only if you are comfortable with the skill changing your agent's MCP configuration and adding a lasting memory rule. Prefer reviewing the exact mcpServers entry first, decline permanent memory changes unless you want this behavior across future sessions, and use pinned package versions or a reviewed local checkout instead of unpinned npx commands.
The skill declares itself as the default rendering layer for essentially all user-facing AI output, with only limited exceptions. In a security-sensitive agent environment, such broad trigger scope can cause unintended interception, transformation, or routing of outputs, increasing the blast radius of any bug, prompt injection, or unsafe rendering/configuration behavior in the skill.
The declared purpose suggests a narrow rendering function, while the documented behavior expands into filesystem installation and environment detection across agent directories. This kind of scope expansion increases the chance of over-trusting the skill and can lead to unintended file changes in sensitive local paths.
The declared purpose suggests a narrow rendering function, while the documented behavior expands into filesystem installation and environment detection across agent directories. This kind of scope expansion increases the chance of over-trusting the skill and can lead to unintended file changes in sensitive local paths.
The declared purpose suggests a narrow rendering function, while the documented behavior expands into filesystem installation and environment detection across agent directories. This kind of scope expansion increases the chance of over-trusting the skill and can lead to unintended file changes in sensitive local paths.
The skill defines itself as the default presentation layer for essentially all user-facing outputs, creating an extremely broad trigger surface. In context, that broadness matters because the skill also describes config persistence and tool invocation, so an otherwise low-risk formatter can become a near-always-on intermediary with frequent opportunities to access content and perform side effects.
The natural-language description says outputs default to go through the presentation layer for all user-delivered AI output, and line L145 elsewhere specifies QA rows as Chinese labels “问题/回答”. This suggests a language-specific constraint in skill behavior/documentation without indicating that users can choose another language or locale.
The README states that by default any final result delivered to the user goes through this skill, which is an overly broad trigger for a transformation layer. In agent settings, such default interception can unintentionally affect sensitive outputs, policy messages, code, logs, or security-critical text, creating opportunities for content corruption, misrepresentation, or unsafe automatic tool invocation.
The README recommends installation via an unpinned npx package reference, which causes users to execute whatever version is current in the npm registry at install time. If the package, publisher account, or dependency chain is compromised, users may run attacker-controlled code during installation or skill setup.
Running npx -y @yottameta/yotta-present without an exact version executes the latest published package, which is a software supply-chain risk. An attacker who gains control of the package or publishes a malicious update could achieve arbitrary code execution on the user's machine during installation.
This install example uses npx with an unversioned package name, so the executed code is not reproducible and may change over time. That exposes users to registry compromise, maintainer compromise, or malicious updates that run locally with the user's privileges.
The --list example still invokes an unpinned package via npx, so even a seemingly harmless listing action requires fetching and executing mutable remote code. Because this is documentation for local tool installation, the context increases practical risk: users may copy-paste and run it directly.
The README says the AI will automatically configure an MCP server and write guardrails into permanent memory on first use, subject to user consent. Persistent modification of agent configuration and memory is security-sensitive because it expands the skill's footprint beyond presentation and can create lasting trust or execution pathways that survive the current session.
The README instructs users to install and execute the package via npx -y @yottameta/yotta-present without pinning a specific version. That makes behavior and trust depend on whatever package version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published.
This command again uses unpinned npx execution, so the resolved package may change over time and can execute newly published code immediately. In an agent-skill context, that increases exposure because installation is part of the trusted setup path and may run with user-level filesystem access.
Even the discovery/listing command uses an unpinned package invocation, which still requires fetching and executing code from the package registry. Although lower risk than a full install path, it remains a supply-chain issue because registry-delivered code is trusted implicitly at runtime.
The skill describes capabilities that read/write local files and modify persistent client configuration, but it declares no explicit tool scope or permission boundaries. In an agent ecosystem, this weakens least-privilege controls and makes it easier for the skill to be invoked with broader filesystem access than users expect.
The embedded permanent-memory text states that the AI will automatically add the MCP server on first use, conflicting with the surrounding consent gate. Because this text is intended for durable reuse, it can propagate unsafe behavior across future sessions and normalize silent persistence without fresh user approval.
L058规定“只要含清单 / 表格 / 结论 / 汇总，就必须先调用 present_result”，这些特征属于常见文本形态，缺少精确定义与排除条件。结果是大量普通答复都可能满足条件，触发边界不稳定，增加误调用风险。
The skill contains contradictory instructions: one section requires explicit user consent before persistent changes, while another says the AI will automatically write mcpServers entries. In practice, ambiguous setup language can cause agents or operators to perform unauthorized persistent configuration changes, which is especially risky because it installs a long-lived local execution pathway.
The skill recommends executing an unpinned npm package with npx -y, which fetches and runs whatever version is current at execution time. If the package is compromised, typo-squatted, or publishes a malicious update, this becomes a supply-chain execution path on the user's machine.
L241中的提示词固定为中文“提示用户：这是可选增强，如需去味可安装，命令……”，整体文档和对外提示也默认中文表达，未说明可根据用户语言切换。对于面向通用用户的技能，这可能构成语言/locale强制而缺少用户选择。
This code file contains user-facing natural-language strings that force a specific language/locale. Under the policy, locale-specific behavior should either offer user opt-in/choice or be clearly justified as region-specific; this file does neither.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
No suspicious patterns detected.
