元安 yotta-security-audit

• Outcome: Pass
• Latest audit: Sep 3, 2026 · 6:55 AM UTC
• Version: 0.2.3

Overview

This is a disclosed security-audit skill whose scanner is read-only, while its separate installer writes the skill into chosen agent skill folders.

Install it only from a source you trust and choose the installer target deliberately. Avoid the -g option unless you really want the skill copied into every supported agent directory. Use system baseline mode only on systems you are authorized to audit, because it may inspect sensitive local security files such as /etc/shadow and sudoers, although the artifact is designed to report redacted findings rather than secrets.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (94)

YARA rule 'exploit_framework': Exploit framework components and payloads [hacktools]

High

• Category: YARA Match

Content

| Exfiltration | Read sensitive files then exfiltrate / archive and upload | high |
| CredentialTheft | SSH/cloud credentials, browser data, system credential-store access | critical |
| NetworkCall | Reverse connections, raw sockets, HTTP clients (mostly context-dependent) | medium |
| PrivilegeEscalation | Permission-bit changes, setuid, joining admin groups | high |
| SocialEngineering | Social-engineering wording in names (file names) | medium |
| Base64 | Overlong base64 strings (upgraded if decoding reveals sensitive keywords) | medium→high |
| IOCMatch | Known malicious IP/domain/URL patterns/file hashes | critical |
| PostInstallHook | Install-time lifecycle scripts (download/execute is critical) | high→critical |
| HiddenChar | Zero-width and bidirectional override characters | medium |
| Entropy | High-entropy encoded strings (suspected obfuscated/encrypted payloads) | medium |

> The rule table lives in scripts/audit_rules.py (signature data file, self-scan

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding strengthens the same concern: the skill claims it only detects and reports, yet it reportedly writes to multiple user-level skill directories and removes .git content from copied targets. Self-replication or multi-directory deployment combined with removal of repository metadata can obscure provenance, hinder review, and create supply-chain risk even if framed as installation logic.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: This finding strengthens the same concern: the skill claims it only detects and reports, yet it reportedly writes to multiple user-level skill directories and removes .git content from copied targets. Self-replication or multi-directory deployment combined with removal of repository metadata can obscure provenance, hinder review, and create supply-chain risk even if framed as installation logic.

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_audit.py --target skill

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_audit.py --target skill

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_audit.py --target skill

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_audit.py --target skill

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

python3 scripts/yotta_audit.py --target skill

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Intent-Code Divergence

High

• Confidence: 96% confidence
• Finding: The file openly presents itself as an installer, which conflicts with the stated skill boundary that it is 'read-only' and never performs modification actions. This misrepresentation can cause users or higher-level agents to authorize execution under false assumptions, increasing the chance of unintended filesystem modification across multiple agent directories.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The manifest says the tool '只检测与报告，绝不执行修复、删除或查杀动作', which communicates a read-only boundary. In this file, installTo creates directories and copies the package into user or project skill directories, which is a modifying/install action rather than detection or reporting.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}

• Confidence: 95% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

| 开放端口 | ss -tln（降级 /proc/net/tcp） | 对外监听端口 |
| 用户 crontab | crontab -l | 持久化脚本 |
| PATH 劫持 | 环境变量 PATH 分析 | PATH 含可写目录可致命令劫持 |
| CIS：空密码账号 | 读取 /etc/shadow | 密码字段为空 = 无需密码可登录，高危 |
| CIS：sudo NOPASSWD | 读取 /etc/sudoers 与 /etc/sudoers.d | 免密提权条目（NOPASSWD），中危 |
| CIS：内核参数加固 | sysctl（suid_dumpable / ASLR / ICMP 重定向 / IP 转发） | 内核参数是否处于安全基线值 |
| CIS：登录历史 | lastb -n 50 / last -n 10 | 失败登录（暴力破解迹象）与近期登录核查 |

• Confidence: 95% confidence
• Finding: Referencing /etc/shadow is sensitive because that file contains password hash metadata and normally requires elevated access. Even though the stated purpose is to detect empty password fields and the document says outputs are redacted, a skill that reads /etc/shadow crosses into credential-access territory and could expose highly sensitive authentication data if implementation or logging is mishandled.

Credential Access

High

• Category: Privilege Escalation

Content

r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",

• Confidence: 70% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# ── PrivilegeEscalation 权限提升 ──────────────────────────────────────
    Rule("PRI-001", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+[0-7]*[267][0-7]{2}\b",
         "chmod 设置 setuid/setgid/sticky 权限位", 85),
    Rule("PRI-002", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+777\b",
         "chmod 777 全权限", 70),

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def run_cli(args, cwd=None, env=None):
    full_env = dict(os.environ)
    if env:
        full_env.update(env)
    return subprocess.run(

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def run_cli(args, cwd=None, env=None):
    full_env = dict(os.environ)
    if env:
        full_env.update(env)
    return subprocess.run(

• Confidence: 60% confidence
• Finding: Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Static analysis

No suspicious patterns detected.