元公 yotta-school-doc

• Outcome: Review
• Latest audit: Sep 24, 2026 · 4:21 PM UTC
• Version: 0.1.2

Overview

The document checker is local and purpose-aligned, but its installers can persistently copy the skill into multiple agent skill directories without confirmation or overwrite safeguards.

Install only if you are comfortable with an installer modifying agent skill directories. Prefer a specific target such as --agent or --dir, avoid --global unless you really want every supported agent affected, and consider pinning the npm version or installing from a reviewed source. Review existing yotta-school-doc folders first because the installers do not warn before overwriting files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (28)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A document-validation skill that also performs tar-based packaging/extraction and installation management across multiple agent-specific paths introduces materially different risk than advertised. If exploited or misused, such behavior could overwrite files, plant content in trusted skill locations, or persist unexpected artifacts, and the deceptive presentation makes those actions more dangerous because operators are less likely to review them carefully.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

A document-validation skill that also performs tar-based packaging/extraction and installation management across multiple agent-specific paths introduces materially different risk than advertised. If exploited or misused, such behavior could overwrite files, plant content in trusted skill locations, or persist unexpected artifacts, and the deceptive presentation makes those actions more dangerous because operators are less likely to review them carefully.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

Using npx -y @yottameta/yotta-school-doc without an explicit pinned version causes users to execute whatever package version is current at install time. If the npm package is later compromised, replaced, or updated with malicious postinstall/runtime behavior, users following the README could run unreviewed code on their local machine.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 97% confidence

Finding

This unpinned npx command has the same supply-chain risk as the previous one: it fetches and executes the latest published package version at runtime. In the context of an agent skill installer, that can modify local skill directories and execute arbitrary package code if the upstream package or publisher account is compromised.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The README instructs users to execute an unpinned npm package via npx, which will fetch the latest published version at runtime. If the package is later compromised, a malicious version is published, or the maintainer account is hijacked, users could execute attacker-controlled code during installation or setup.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This command also uses npx with an unpinned package version, creating a supply-chain execution risk because the resolved code can change over time. In a skill-installation context, this is particularly relevant because users are being told to run the command directly on their systems.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · bin/install.js (reported line 25)May include surrounding context.

js

const AGENT_DIRS = {
  claude:    { label: 'Claude Code',      dirs: ['.claude/skills'] },
  cursor:    { label: 'Cursor',           dirs: ['.cursor/skills', '.agents/skills'] },
  codex:     { label: 'Codex',            dirs: ['.codex/skills'] }, // 特判：$CODEX_HOME/skills
  gemini:    { label: 'Gemini CLI',       dirs: ['.gemini/skills', '.agents/skills'] },
  goose:     { label: 'Goose',            dirs: ['.config/goose/skills', '.agents/skills'] },
  amp:       { label: 'Amp',              dirs: ['.config/agents/skills', '.agents/skills'] },

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

清单将该技能描述为本地离线的学校公文骨架生成与确定性检查工具，强调不联网、不调用模型，但未表述其还包含一个会在用户级或项目级智能体目录中创建目录并复制整套技能文件的安装器。L060-L064 的实际行为是执行文件系统写入与部署，这属于与文档处理本身不同的操作能力。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The installer creates the target directory and copies files into it without any confirmation, dry-run preview, or overwrite warning. If a user supplies the wrong path or auto-detected directories already contain an existing skill of the same name, the script can silently replace content and alter agent behavior, which is especially sensitive because installed skills influence downstream AI tooling.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

L122-L131 的 -g/--global 分支会遍历多个已知智能体目录并批量写入技能，这是一种跨工具部署能力，而非学校公文生成/检查的直接需求。就该技能宣称的用途而言，这类面向多智能体环境的批量安装能力并未在清单中得到正当化说明。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The --global path performs repeated directory creation and file extraction across all known agent skill locations. Although the script prints that it is installing to all known directories, there is no confirmation prompt or stronger warning comment/docstring highlighting the breadth of these filesystem writes before they occur.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · install.sh (reported line 123)May include surrounding context.

sh

echo "完成。"; return
  fi
  local installed=0 d
  for d in .claude/skills .cursor/skills .codex/skills .config/goose/skills .config/agents/skills .opencode/skills .codeium/windsurf/skills .workbuddy/skills .kiro/skills .traecli/skills .gemini/skills .trae-cn/skills .qwen/skills .comate/skills .codebuddy/skills .kimi/skills .agents/skills; do
    if [ -d "$d" ]; then install_to "$d"; installed=1; fi
  done
  if [ "$installed" = "0" ]; then

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The description lists broad natural-language triggers such as 'validating a school document' and 'checking missing fields and dates,' which overlap with common document-review requests and do not clearly constrain when the skill should or should not activate. While the domain is school documents, the trigger scope is still expansive and lacks explicit exclusion examples or narrower invocation boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown file presents all instructions, field descriptions, and examples only in Chinese, which can functionally force a specific language on users. The file does not offer an opt-in language choice or explain that the skill is intentionally limited to a Chinese-language or region-specific context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The module docstring and user-facing disclaimer are entirely in Chinese and describe the tool as a school-document drafting/checking engine, implying a fixed language/locale for interaction and output. There is no natural-language indication that users may choose another language or locale, which can violate a language/locale policy when no opt-in is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file is entirely written in Chinese, beginning with the Chinese heading and continuing throughout, with no indication that language selection is optional or that this file is intentionally region-specific. Under the policy rule for natural-language violations, this can be considered a locale/language constraint without explicit opt-in or justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Line L001 explicitly labels the README language as English and offers Chinese only via a separate link, which indicates a default language choice rather than presenting language selection neutrally. Under the stated policy, forcing or defaulting to a specific language without explicit user opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

Line L001 presents the document language as Chinese by default, with English only as an alternate link. Under the policy for natural-language violations, this is a locale/language preference imposed in the file without offering an explicit in-content choice or opt-in workflow.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.