Security audit
Security checks for vulnerabilities and agentic risk
This is a disclosed release-checking and publishing helper; it can install itself and run publishing commands when explicitly invoked, but I found no hidden data theft or destructive behavior.
Install only if you want a publishing gate that can inspect skill projects and, when explicitly run with --exec, create/push repositories and publish through your locally authenticated npm, GitHub, and ClawHub CLIs. Review dry-run output before execution and prefer a pinned package version for npx installs.
声明描述的是一个“发布前检查/发布守门”能力集合，重点在校验、版本核对、名称查重和发布命令封装；而给定代码块实际上是一个安装器，不做任何发布前检查、版本对齐、名称查重、聚合 verdict、npm pack 校验或 publish 封装。它的主功能是解析安装参数、定位各智能体技能目录、复制文件到目标位置，并清理旧残留。虽然安装器可能属于该项目的配套组件，但就这段代码本身而言，其实际行为与声明的核心用途明显不一致，且包含未在声明中体现的本地安装/文件写删能力，因此应判定为描述与行为不匹配。
The declared description focuses on release-gating functionality: check aggregation, package-content validation, version consistency checks, duplicate-name lookup, and publish command orchestration. The actual code chunk does none of those things. Instead, it is purely an installer for the skill itself, handling target directory selection, path resolution, safe-copy behavior, cleanup of previous installs, and listing supported agents. This is a materially different primary purpose, not merely a supporting implementation detail of the declared release-guard behavior. No evidence in this code chunk shows the promised publish/check/version/name-check capabilities.
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
Referenced artifact was not completely inspected
python3 scripts/yotta_publish_guard.py check ./yotta-my-tool
The manifest describes a pre-publish guard that validates checks, package contents, versions, names, and wraps publish commands, explicitly framing the skill as a release-checking tool. This file instead implements a standalone installer that writes the skill into agent directories, recursively copies package contents, and deletes prior install residue; that operational behavior is materially different from the claimed release-gating purpose.
The trigger list includes generic phrases such as "查重" and "版本对齐," which are common task-oriented expressions rather than uniquely scoped invocations for this specific skill. Because the line mixes broad activity descriptions with trigger words and provides no negative examples or exclusion conditions, the activation scope is ambiguous and could cause unintended invocation.
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| 元守 yotta-publish-guard (this skill) | **Guard**: pre-publish validation + publish command wrapper |
| 元造 yotta-skill-creator | **Create**: compliant scaffold (元守's check is READY directly on 元造 scaffolds) |
Recommended flow: **元造 create → develop → 元守 check → pack → versions → names → publish**.
References: `references/tutorial.md` (Chinese tutorial), `references/check-items.md` (validation item details), `references/publish-flow.md` (three-source release flow + pitfall list).
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-publish-guard --agent <agent-name> # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-publish-guard --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)
The README instructs users to run npx -y @yottameta/yotta-publish-guard without pinning a specific package version. That means each execution may fetch the latest published package, so a compromised maintainer account, malicious new release, or dependency-chain issue could cause unreviewed code to run on the user's machine.
This is the same unpinned npx execution pattern on a second line, again allowing remote code execution from whatever package version is current at runtime. In security-sensitive tooling, especially release tooling, encouraging mutable package resolution increases supply-chain exposure.
该 markdown 文件适用 SQP-1。L015 列出的触发词包含“查重”“版本对齐”等通用短语，缺少明确上下文限定或排除示例，这些表达可出现在很多普通开发对话中，容易与非本技能意图重叠。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| 元守 yotta-publish-guard（本技能） | **守**：发布前全量校验 + 发布命令封装 |
| 元造 yotta-skill-creator | **造**：生成合规脚手架（元守的 `check` 对元造脚手架直接 READY） |
推荐链路：**元造 create → 人工开发 → 元守 check → pack → versions → names → publish**。
参考资料：`references/tutorial.md`（中文教程）、`references/check-items.md`（校验项明细）、
`references/publish-flow.md`（三源发布流程与已踩坑清单）。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| 元守 yotta-publish-guard(本技能) | **守**:发布前全量校验 + 发布命令封装 |
| 元造 yotta-skill-creator | **造**:生成合规脚手架(元守的 `check` 对元造脚手架直接 READY) |
推荐链路:**元造 create → 人工开发 → 元守 check → pack → versions → names → publish**。
参考资料:`references/tutorial.md`(中文教程)、`references/check-items.md`(校验项明细)、
`references/publish-flow.md`(三源发布流程与已踩坑清单)。
The README instructs users to execute npx -y @yottameta/yotta-publish-guard without pinning a package version. This causes the latest package to be fetched and executed at install/runtime, so a compromised maintainer account, malicious new release, or dependency-chain attack could lead to arbitrary code execution on the user's machine.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# 可选国内加速：npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-publish-guard --agent <智能体名称> # 装到指定智能体默认用户级技能目录
npx -y @yottameta/yotta-publish-guard --dir <智能体的技能目录> # 指到技能目录本身（如 ~/.codex/skills）
--agent <name> 自动装到该智能体默认用户级目录；--list 可查看各智能体默认目录。Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# 可选国内加速:npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-publish-guard --agent <智能体名称> # 装到指定智能体默认用户级技能目录
npx -y @yottameta/yotta-publish-guard --dir <智能体的技能目录> # 指到技能目录本身(如 ~/.codex/skills)
--agent <name> 自动装到该智能体默认用户级目录;--list 可查看各智能体默认目录。This line repeats the same unsafe pattern: an unpinned npx invocation that downloads and runs code from npm. If the package is updated maliciously or the publishing pipeline is compromised, users following the README could execute attacker-controlled code.
No suspicious patterns detected.