元公 yotta-school-doc

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 6:01 PM UTC
• Version: 0.1.5

Overview

The skill performs its advertised local document checks, with ordinary installation and file-overwrite precautions.

Prefer a reviewed, version-pinned release or the reviewed local installer. Select one destination and preview installation with --dry-run; global mode affects multiple agents. Back up custom skill edits before reinstalling and choose output paths carefully. Keep reports private because they can quote student information. The scanner's material gaps were investigated directly in the bundled source; future npm downloads remain outside this review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (16)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk is an installer, not a document-generation or validation implementation. Its substantive behavior modifies AI-agent skill installations, which the declared description does not disclose. Although installation can support the larger skill, this chunk's primary function and filesystem effects are materially different from the stated document-processing purpose. No document checks, skeleton generation, or --gate functionality appear here. The code does remain local and contains no network or model calls; this assessment does not establish that the omitted package files lack the advertised features or that the installer is malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Although installation commands can be supporting implementation details, these commands use npx -y, which can download and execute a package without confirmation when it is not already available locally. That conflicts with the description's explicit local-only, no-network characterization. A cached package could avoid a download, so network access is not inevitable on every invocation. The supplied chunk does not establish whether the package performs the promised document checks or has any additional behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx one-liner'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Although this is an installer rather than an MCP server, the recommended command executes an npm package without selecting a reviewed version, and -y suppresses the installation prompt. A compromised future release could execute with the user's permissions, exposing local school documents or modifying agent skills; local-only document processing does not prevent this installation-time risk.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The custom-directory installation example executes whichever package version npm resolves, rather than a reviewed release. If a later release is compromised, it can execute with the user's permissions and tamper with local files or agent instructions; the --dir argument does not sandbox package execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This recommended installer command executes an unpinned npm release with automatic confirmation, despite not being an MCP server. A compromised future release could access sensitive school data or alter user-level agent skills using the installing user's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The command retrieves and executes an npm package without binding installation to a reviewed version. A compromised release would run with the user's permissions, and choosing a destination directory does not limit its access to other local files.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

This comment documents an unpinned npm execution command, not an MCP server configuration. Following it could execute a compromised future package release with user privileges and install altered instructions into a user-level agent skill directory.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documented --dir command executes a package version selected at invocation time rather than a reviewed release. A compromised package could access local data or modify agent instructions beyond the chosen directory because --dir is not an execution sandbox.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This unpinned npm command documents installation across all known user-level agent destinations. If the resolved release is compromised, executing it can compromise the user's files, while the global installation mode also spreads altered skill content across multiple agents.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The bare installation example executes an unpinned package before installing into detected project agent directories. A compromised future release could execute arbitrary code with the user's permissions and introduce persistent malicious skill content into those projects.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Even a --list invocation causes npx to obtain and execute the unpinned package before its argument handling runs. The supplied installer only lists directories on this path, but a compromised future release would not be constrained by that behavior and could access sensitive local data.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The --dry-run flag prevents installation writes in the supplied implementation, but it does not stop npx from executing an unpinned package. A compromised release could ignore the flag, so dry-run is not a security boundary against installation-time supply-chain compromise.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

Using --version does not avoid package execution: npx still resolves and runs an unpinned release. Although the supplied implementation only reads version metadata on this path, a compromised release could execute arbitrary code with the user's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-school-doc'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The help example still obtains and executes an unpinned npm package, despite appearing informational. A compromised release could run malicious code before displaying help, exposing local school documents or agent configuration.

Content

No source excerpt is available for this finding.