元钥 yotta-secret

• Outcome: Review
• Latest audit: Nov 6, 2026 · 6:02 PM UTC
• Version: 0.2.4

Overview

This local secret scanner needs review because its supposedly masked reports can reveal complete secrets.

Do not treat default reports as safe to share: complete secrets can appear in their context snippets. Keep reports private until masking is corrected and verified. Limit scans to authorized paths, pin the reviewed package version, and select one installation destination explicitly. Back up an existing installation before updating. Installer coverage gaps were manually investigated, but filesystem changes were not dynamically tested.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (25)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 9)May include surrounding context.

md

<h1 align="center">yotta-secret · 元钥 (Yuanyao)</h1>

<p align="center">YottaMeta's zero-dependency secret & credential leak scanner: finds <b>cloud API keys, private keys, credential assignments, URL-embedded credentials and high-entropy tokens</b> in source code, config files, .env and git history using <b>regex + entropy + format validation</b>; outputs <b>text / JSON / CSV</b> with secrets masked by default.</p>
<p align="center">Activates when the user needs to check a repo / config for leaked API keys, passwords, private keys or tokens before commit or release, scan directories or git history for hardcoded credentials, verify whether a string looks like a known key format, or redact secrets from logs / tickets before sharing — <b>fully local and offline: no connectivity checks, no data leaves the machine</b>.</p>
<p align="center">No external tools required (Python 3.8+ standard library); Windows + Linux + macOS; every result ships a masked secret form plus a Chinese plain-langua

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.zh-CN.md (reported line 9)May include surrounding context.

md

<h1 align="center">yotta-secret · 元钥 (Yuanyao)</h1>

<p align="center">YottaMeta 的零依赖密钥 / 凭据泄露源头扫描引擎：用「正则 + 熵 + 格式校验」离线扫描源码 / 配置 / .env / git 历史，覆盖云厂商 API Key、私钥、口令赋值、URL 内嵌凭据与高熵长 token，输出 text / JSON / CSV。</p>
<p align="center">触发场景：提交或发布前排查仓库是否泄露密钥、扫描目录或 git 历史找硬编码凭据源头、校验某字符串是否为已知格式密钥、在分享日志 / 工单前给文本脱敏。</p>
<p align="center">纯 Python 3.8+ 标准库实现，零外部依赖，Windows + Linux + macOS 通用；输出默认打码，防二次泄露。</p>

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 7)May include surrounding context.

md

version: 0.2.4
displayName: 元钥·密钥泄露扫描
summary: 密钥泄露源头扫描：正则 + 熵 + 格式校验离线扫描源码、配置、git 历史，默认打码防二次泄露。
description: '元钥 —— 跨智能体的密钥 / 凭据泄露源头扫描技能：零依赖自研用「正则 + 熵 + 格式校验」离线扫描源码 / 配置 / .env / git 历史中的疑似密钥与凭据（云厂商 API Key、私钥、口令赋值、URL 内嵌凭据、高熵长 token），输出 text / JSON / CSV，默认打码防二次泄露。触发：用户要排查代码 / 配置 / 仓库里是否泄露了 API Key、密码、私钥、token，要在提交或发布前做密钥检查，或要校验某个字符串是否为已知格式的密钥时。边界：纯本地离线扫描，不联网验证密钥是否有效、不发送任何数据；结果只是「疑似密钥」，是否真实需人工核实；仅用于已获授权 / 自有资产 / 教学环境。'
tags: [密钥扫描, 凭据泄露, 源码检测, 安全扫描, secret, 泄露]
category: it-ops-security
license: MIT

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 16)May include surrounding context.

md

# 元钥（yotta-secret）

跨智能体的密钥 / 凭据泄露源头扫描技能：零依赖自研用**「正则 + 熵 + 格式校验」**离线扫描
**源代码 / 配置文件 / .env / 日志 / git 历史**中的疑似密钥与凭据，覆盖
**云厂商 API Key、私钥、口令赋值、URL 内嵌凭据、高熵长 token** 五类，
输出 **text / JSON / CSV**，默认打码（--show-secret 才明文）。

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

masked_snippet() replaces only the current match and retains the surrounding line. If a line contains multiple credentials, each finding's snippet can expose the other credentials verbatim. Both normal scans and Git-history scans use this function, and text, JSON, and CSV reports include these snippets. Consequently, masking the secret field does not reliably prevent secondary disclosure in default output. The primary scanning purpose and offline behavior otherwise match the description; the related utility commands are supporting functionality, not unrelated capabilities.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The supplied executable primarily installs and updates a skill rather than scanning for leaked credentials. Its persistent filesystem changes across agent directories are not described by the declared scanning purpose and are more substantial than internal scanner implementation details. This may be legitimate distribution tooling, but its behavior is not represented in the supplied description. The finding is limited to this chunk: it does not establish that the rest of the package lacks a scanner or that the installer transmits data.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json

{
  "name": "@yottameta/yotta-secret",
  "version": "0.2.4",
  "description": "Yuanyao — a zero-dependency secret & credential leak scanner for AI agents: scans source code, config files, .env and git history for cloud API keys, private keys, credential assignments, URL-embedded credentials and high-entropy tokens using regex + entropy + format validation; outputs text / JSON / CSV with secrets masked by default. Pure Python 3.8+ standard library. Triggers when the user needs to check a repo / config for leaked API keys, passwords, private keys or tokens before commit or release, scan directories or git history for hardcoded credentials, verify whether a string looks like a known key format, or redact secrets from logs / tickets before sharing. Boundaries: fully local and offline; no connectivity checks, no leak-database lookups, no data leaves the machine; results are suspected secrets only, verified by humans; authorized / own-asset / educational use only.",
  "license": "MIT",
  "ke

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_secret.py (reported line 8)May include surrounding context.

python

================================================================

跨智能体的密钥泄露源头扫描：用「正则 + 熵 + 格式校验」离线扫描源代码 / 配置文件 /
.env / 文本中的疑似密钥与凭据，覆盖 云厂商 API Key、私钥、通用口令赋值、
URL 内嵌凭据、高熵长 token 五类。

特性

Default scan reports can expose plaintext secrets through partially masked context snippets.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Each finding masks only its own matched span before copying the surrounding line into snippet, leaving other credentials on that line visible. Consequently, default text, JSON, and CSV reports can disclose plaintext secrets despite --show-secret being disabled; deduplication and truncation do not reliably prevent this.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 75)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-secret@0.2.4 --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-secret@0.2.4 --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documented installation command executes an unpinned npm package with automatic confirmation, so a future compromised release could execute with the user's filesystem access. This is an installation supply-chain risk rather than an MCP reference or malicious behavior in the installer itself; the secret-scanning context increases the sensitivity of accessible files.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The custom-directory installation example executes the current npm release without pinning it or prompting for confirmation. Although this is documentation rather than an automatic subprocess call, following it could execute a compromised future release with access to local credentials.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

This example executes an unpinned npm release and installs its skill content across known user-level agent directories. A compromised release could therefore execute locally and distribute attacker-controlled instructions to multiple agents, although no compromise is demonstrated here.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The default installation example resolves a mutable npm release and executes it using automatic confirmation. The risk is conditional on package compromise or an unsafe future release, not evidence that the supplied installer is malicious or an MCP server.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Even the listing example asks npx to resolve and execute an unpinned package before processing --list. The supplied implementation only lists directories on this path, but that does not constrain what a compromised future package could execute.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The dry-run example still executes an unpinned npm package; --dry-run only controls behavior implemented inside that package. It does not sandbox package execution or protect against a compromised release.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

Requesting --version through this example still executes whatever release the unpinned npm reference resolves to. The benign version-display branch in the supplied code does not eliminate the conditional supply-chain risk.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The help example executes a mutable npm release with automatic confirmation before displaying help. This is a conditional supply-chain exposure in usage guidance, not evidence of an MCP server or malicious instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-secret'.

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

Although this is not an MCP server, the active troubleshooting instructions recommend executing an unpinned npm package with automatic confirmation. A compromised or unexpected future release could execute with the installing user's privileges and modify agent skill files; the scanner's offline runtime boundary does not protect the installation step.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/yotta_secret.py (reported line 515)May include surrounding context.

python

"""扫描 git 历史：git log -p --all，只扫新增行。"""
    repo = path or "."
    try:
        r = subprocess.run(
            ["git", "-C", repo, "log", "-p", "--all", "--"],
            stdout=subprocess.PIPE, stderr=subprocess.PIPE, timeout=120)
    except (FileNotFoundError, subprocess.TimeoutExpired):

Every result includes a Chinese-language context line without offering an output-language choice.

Low

• Category: Output Handling
• Confidence: 95% confidence

Finding

The description specifies that every result includes a Chinese plain-language context line, imposing a specific output language without user opt-in or a documented locale-specific justification. The English/Chinese README links offer documentation choices, not a choice of result language.

Content

No source excerpt is available for this finding.