元引 yotta-prompt

• Outcome: Review
• Latest audit: Sep 3, 2026 · 6:52 AM UTC
• Version: 0.1.2

Overview

This is mostly a local prompt-clarification helper, but it tells agents to persistently auto-enable it in future sessions without asking the user.

Review this skill before installing if you do not want an assistant to auto-load it in every session. The local CLI appears offline and limited, but remove or disable the permanent-memory/startup-registration instructions unless you explicitly want that persistent behavior. Prefer pinned package versions over the documented unpinned npx commands.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (54)

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The skill is described as `always-load at session start` and triggers on broad conditions like vague language or users not knowing what they want. Overly broad automatic activation increases the chance of unintended interception of ordinary conversations and can cause prompt-scope overreach, especially because it routes users into other skills and emits ready-to-run prompts.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The README explicitly states the skill is automatically injected into every new session via `always-load`, with broad triggers like vague input or users not knowing what to ask. That creates an overly broad activation scope that can silently influence unrelated conversations, increase prompt-surface area, and amplify prompt-injection or policy-bypass opportunities because the skill becomes ambient rather than explicitly invoked.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The English description similarly frames the skill as a local offline prompt-routing assistant, while the behavior extends to copying source trees, enumerating platform paths, creating directories, and providing install/list management commands. Such hidden operational scope increases the chance of unauthorized persistence or environment tampering under the guise of a benign onboarding skill.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The English description similarly frames the skill as a local offline prompt-routing assistant, while the behavior extends to copying source trees, enumerating platform paths, creating directories, and providing install/list management commands. Such hidden operational scope increases the chance of unauthorized persistence or environment tampering under the guise of a benign onboarding skill.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The skill is marked always-load at session start and is designed to trigger on vague or common user behavior, which applies to a very broad set of ordinary interactions. Overbroad triggers in a persistent skill can let it intercept many unrelated conversations, bias the agent's behavior, and increase the chance of unwanted instruction precedence.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: The skill explicitly instructs the agent to register itself in permanent memory, persistent skill lists, or startup configuration and to auto-enable it in future sessions. This is a persistence mechanism that exceeds the claimed purpose and can modify long-term agent behavior without informed user approval.

Ssd 1

High

• Confidence: 98% confidence
• Finding: The instructions direct the agent to persist and auto-activate the skill across future sessions without requiring contemporaneous user confirmation. This effectively increases the skill's control over future system behavior and resembles unauthorized self-installation or privilege expansion within the agent environment.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def run_cli(*args):
    """以子进程方式运行 CLI（Windows 下也保证 UTF-8 输出）。"""
    env = dict(os.environ)
    env["PYTHONIOENCODING"] = "utf-8"
    return subprocess.run(
        [sys.executable, SCRIPT] + list(args),

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence
• Finding: The changelog recommends executing an unpinned package via `npx`, which fetches the latest published version at runtime. If the package is later compromised, typo-squatted, or updated with malicious code, users following the documented command could execute attacker-controlled code on their systems.

Natural-Language Policy Violations

Medium

• Confidence: 88% confidence
• Finding: The command description states '2-4 candidate directions with Chinese explanations,' and the sample output is also in Chinese, despite the README presenting English as a language option at the top. This suggests a locale/language behavior that may be imposed by default rather than chosen by the user.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
# Clarify a vague phrase into 2-4 candidate directions
python3 scripts/yotta_prompt.py clarify "help me write an email"

# JSON output for programmatic consumption
python3 scripts/yotta_prompt.py clarify "remember this" --json

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-prompt --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-prompt --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Natural-Language Policy Violations

Medium

• Confidence: 84% confidence
• Finding: The file presents Chinese as the active language variant and does not offer any in-file language choice beyond linking to a separate English document. This can be read as a locale-specific presentation without explicit user opt-in in the skill behavior description itself.

Static analysis

No suspicious patterns detected.