元析 yotta-recon

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:53 AM UTC
• Version: 0.1.6

Overview

This is a disclosed network reconnaissance skill with authorization checks, local-only installation behavior, and no evidence of exfiltration, exploitation, persistence, or destructive actions.

Install only if you need a port and service reconnaissance tool, and use it only on systems you own or are explicitly authorized to test. Prefer a scope file, avoid global multi-agent installation unless intentional, and pin the npm version if you need supply-chain reproducibility.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (52)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A second independent mismatch report says the code lacks any actual network scanning or fingerprinting logic while performing file writes, directory creation, and cross-agent installation based on HOME/CODEX_HOME/XDG paths. A security skill that claims to be read-only reconnaissance but instead modifies local state is especially dangerous because it can evade scrutiny under the cover of legitimate security tooling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: A second independent mismatch report says the code lacks any actual network scanning or fingerprinting logic while performing file writes, directory creation, and cross-agent installation based on HOME/CODEX_HOME/XDG paths. A security skill that claims to be read-only reconnaissance but instead modifies local state is especially dangerous because it can evade scrutiny under the cover of legitimate security tooling.

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_recon.py scan --targets 127.0.0.1 --top 100

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence
• Finding: The changelog recommends executing the package via `npx -y @yottameta/yotta-recon` without pinning an exact version. This creates a supply-chain risk because future or compromised package versions could be fetched and executed implicitly, which is especially sensitive for a security-recon skill that users may run with elevated trust.

Vague Triggers

Medium

• Confidence: 97% confidence
• Finding: The README says the skill activates when a user asks to "scan a network / ports, identify services or version fingerprints, inventory assets, trace CDN origins, or run the recon phase of a security test" and adds that this is "judged by the target, not keyword luck." This provides no bounded trigger list or negative examples, and several phrases such as "inventory assets" are broad enough to overlap with common IT requests, increasing the risk of unintended invocation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Advantage | Description |
|---|---|
| **Zero dependency** | Python 3.8+ standard library; no daemon / database / external scanner; Windows + Linux + macOS |
| **Authorization discipline** | Only loopback is allowed by default; scope file or explicit declaration are the two authorization paths; in agent scenarios, no confirmation means denial |
| **Gentle & tunable** | Concurrency (--concurrency), timeout (--timeout) and rate limit (--rate) are adjustable to avoid scan storms |
| **Explainable fingerprints** | Product / version / risk level output item by item; risk hints match only, never exploit, and require human verification |
| **Flexible targets** | IP / CIDR / hostname / target file; custom ports or the built-in common-port table |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-recon --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-recon --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)
```

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The README instructs users to execute `npx -y @yottameta/yotta-recon` without pinning a specific package version. This creates a supply-chain risk: installs will fetch whatever the latest published package is at execution time, so a compromised maintainer account, malicious new release, or dependency confusion event could cause arbitrary code to run on the user's machine during installation.

Static analysis

No suspicious patterns detected.