元引 yotta-prompt

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 5:55 PM UTC
• Version: 0.2.6

Overview

This skill coherently provides offline task clarification, with optional installation and persistent activation that users should scope carefully.

Choose a single agent or directory and preview installation changes. Installers can overwrite this skill's files and remove development residues. Generated -g commands target multiple agents; replace them with a scoped option when appropriate and pin a reviewed package version. Enable persistent activation only if wanted, and review generated prompts for language and memory-writing instructions. This review covers the bundled files, not future npm releases or recommended third-party skills.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk implements package deployment, not the declared conversational workflow. Although installation can support a skill, this code's primary behavior is independently invoked, persistent filesystem modification, including broad multi-agent installation and cleanup operations that the description does not disclose. No intent clarification, candidate generation, requirements gathering, or routing is implemented here. The code is consistent with the offline claim: it contains no network access. This assessment is limited to the supplied installer and does not establish how the installed skill behaves.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

md

> `npx -y @yottameta/<技能名> --agent <智能体名>` 或 `install.sh`。

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Activation covers vague phrases and single words across ordinary conversation without clear invocation boundaries.

Medium

• Category: Trigger Abuse
• Confidence: 94% confidence

Finding

The skill activates whenever a user says something vague or supplies a single word, and is always loaded at session start. These conditions can capture ordinary conversational replies or already-contextualized requests; the description does not specify activation exclusions for those cases.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-prompt --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-prompt --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended command executes a remotely resolved npm package without pinning its version, while -y suppresses the package-install confirmation. Although this is an installer rather than an MCP server, a compromised publisher or malicious future release could execute code with the user's privileges and install persistent agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This alternate installation command also executes an unpinned npm package with confirmation suppressed. Selecting a destination directory does not constrain the executed package's privileges, so a compromised release could modify other accessible files or implant agent instructions.

Content

No source excerpt is available for this finding.

The skill activates for broadly defined vague input and is automatically loaded in every new conversation, without exclusion conditions.

Medium

• Category: Trigger Abuse
• Confidence: 94% confidence

Finding

The stated triggers include users not knowing what they want or entering a vague sentence or single word, which can overlap with ordinary requests across almost any domain. Combined with automatic loading in every new session and no stated exclusions, this leaves insufficient boundaries for when the clarification workflow should actually engage.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended npm installer is executed without an exact version, and -y suppresses the package-install confirmation. This is not an MCP configuration, but a compromised future package release could run with the user's privileges and persist malicious content in an agent's skills directory.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The custom-directory installation example executes the same mutable, unpinned npm package. The --dir argument specifies an intended destination but does not sandbox the installer, leaving the user's accessible files exposed if the resolved release is compromised.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The documented command recommends executing an unpinned npm package with confirmation suppressed, so a compromised future release could execute code with the user's permissions. This is an installer rather than an MCP server, and the comment does not execute automatically, but following it also permits installation into persistent agent skill directories.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

This installation example executes a mutable, unpinned npm release with confirmation suppressed. Although it is documentation rather than automatic execution and does not reference an MCP server, a user following it could run a compromised release with their local permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The example executes an unpinned npm release and requests installation across all known user-level agent directories. A compromised release could execute arbitrary local code and distribute persistent malicious skill instructions across multiple agents; the command is only documented, not automatically run.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Following this example executes an unpinned npm package with the user's permissions before installing into detected project agent directories. The comment itself is inert and this is not an MCP server, but a compromised release could introduce both executable code and persistent agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Even a listing operation invokes the unpinned npm package's executable entry point, so a compromised release could run arbitrary code before displaying directory information. This is a conditional supply-chain risk in documented usage, not an automatic download or an MCP-server configuration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The dry-run flag only controls the intended installer's behavior after npm has selected and executed the unpinned package. It cannot prevent a compromised release from executing malicious code, although this documented command does not run by itself.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

Requesting version information through this command still executes an unpinned npm package with local user permissions. A compromised release need not honor the version-only behavior; the risk arises when someone follows the example, not from loading the comment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-prompt'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The help example executes an unpinned npm package before its help flag is processed. Despite being an inert documentation comment and not an MCP reference, it exposes users who follow it to arbitrary code execution if the selected release is compromised.

Content

No source excerpt is available for this finding.

The activation condition covers any vague phrase or single word, making the skill liable to intercept unrelated user input.

Medium

• Category: Trigger Abuse
• Confidence: 94% confidence

Finding

The description activates the skill "when a user types a vague phrase or a single word" and calls it an always-loaded entry-layer skill. This encompasses ordinary short answers and unrelated requests; the stated boundaries describe the skill's behavior but do not clarify which user inputs should not trigger it.

Content

No source excerpt is available for this finding.

The skill activates on any vague sentence or single word without a defined scope or exclusion conditions.

Medium

• Category: Trigger Abuse
• Confidence: 96% confidence

Finding

The FAQ says the skill loads automatically at session start and responds whenever the user enters a vague sentence or a single word, using “报表” (report) as an example. These activation conditions overlap with ordinary conversation and do not distinguish intentional invocation from unrelated input, potentially causing unwanted clarification workflows.

Content

No source excerpt is available for this finding.

The general writing prompt explicitly requires Chinese output without obtaining the user's language preference.

Medium

• Category: Output Handling
• Confidence: 95% confidence

Finding

The writing template begins with “请以中文帮我写 / 润色” (“Please write/polish in Chinese”), imposing a language on general writing requests. Although the CLI offers a --lang interface option, map_result selects this fixed template regardless of that option, so choosing English does not change the generated prompt's Chinese-output requirement.

Content

No source excerpt is available for this finding.

The clarify command specifies Chinese explanations without a user language choice.

Low

• Category: Output Handling
• Confidence: 93% confidence

Finding

The command description explicitly specifies Chinese explanations regardless of the user's language. No output-language option or region-specific justification is provided; the documentation language links do not establish a choice for command output.

Content

No source excerpt is available for this finding.