元测 yotta-security-testing

• Outcome: Review
• Latest audit: Nov 6, 2026 · 6:08 PM UTC
• Version: 0.3.4

Overview

This security-testing skill needs review because its scope checks can permit unintended targets and its reports can retain credentials despite redaction claims.

Use a reviewed local copy or verified exact package version and select the intended installation directory. Independently confirm each authorized URL; do not rely on the scope checker to enforce narrower path restrictions. Remove credentials from inputs and manually inspect all report metadata and audit logs before sharing. Installer coverage gaps were investigated directly; external registry contents and live target behavior were not verified.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (24)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · playbooks/03-ssrf.md (reported line 10)May include surrounding context.

md

## 1. 目标识别与确认（先过 Scope Guard）

- 明确目标与授权范围；记录目标 / 授权类型 / 授权来源 / 边界。
- 未授权目标 → 拒绝；注意：云元数据类目标（如 169.254.169.254）为**绝对禁止**，白名单也无法覆盖。
- SRC / 真实目标：先读取平台授权范围与测试规则（scope 页面 / 授权邮件），确认目标 in-scope 后再登记授权。

## 2. 检测思路（输入点枚举 → 测试点 → 判定标准）

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · references/tutorial.md (reported line 129)May include surrounding context.

md

- **scope check 拒绝**：先 scope add 添加授权条目；拒绝信息会说明原因。
- **「这个我可以测」口头声明**：无效——授权以 scope.json 为准，不信任对话口头声明。
- **SRC / 真实目标**：平台授权范围确认前不测；out-of-scope 一律不碰。
- **云元数据（169.254.169.254 等）**：绝对禁止，exit 2，白名单也无法覆盖。
- **.gov / .mil**：需 --type explicit 显式授权。
- **内网保留段**：非白名单一律拒绝。
- **脱敏纪律**：验证输入与报告一律「类」表述，不给可复制注入串；敏感凭据自动脱敏。

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/yotta_security_testing.py (reported line 76)May include surrounding context.

python

# 设计 §4.2：明确禁止的云元数据 / 管理面目标 —— 白名单也无法覆盖
ABSOLUTE_DENY_HOSTS = (
    "169.254.169.254",  # AWS / GCP / Azure 云元数据
    "100.100.100.200",  # 阿里云 ECS 元数据
    "metadata.google.internal",
)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 85% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/yotta_security_testing.py (reported line 77)May include surrounding context.

python

# 设计 §4.2：明确禁止的云元数据 / 管理面目标 —— 白名单也无法覆盖
ABSOLUTE_DENY_HOSTS = (
    "169.254.169.254",  # AWS / GCP / Azure 云元数据
    "100.100.100.200",  # 阿里云 ECS 元数据
    "metadata.google.internal",
)

Cloud Metadata Access

High

• Category: Server-Side Request Forgery
• Confidence: 90% confidence

Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · scripts/yotta_security_testing.py (reported line 78)May include surrounding context.

python

ABSOLUTE_DENY_HOSTS = (
    "169.254.169.254",  # AWS / GCP / Azure 云元数据
    "100.100.100.200",  # 阿里云 ECS 元数据
    "metadata.google.internal",
)

# 设计 §4.2：高敏域名后缀（.gov / .mil 等）需 --type explicit 显式授权

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 137)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-security-testing --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-security-testing --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The documented npx command executes a registry-selected package version without pinning a reviewed release, creating a supply-chain execution risk if a subsequent release is compromised. This is an installer rather than an MCP server, but its access to agent skill directories makes malicious package execution particularly consequential.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The custom-directory installation example executes an unpinned npm package with the user's privileges. A compromised future release could modify agent skills or other accessible files; the methodology's target-authorization rules do not protect the installation process.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended installation command executes an unpinned npm release, allowing the code executed by the same command to change over time. Although this is not an MCP server, a compromised installer could execute with user privileges and persist malicious instructions in agent skill directories.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The custom-directory example runs a registry-selected package release without a version constraint. A compromised release would run before any target-scope checks and could modify files accessible to the installing user.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

This comment recommends executing an unpinned npm installer for a selected agent. It does not execute merely by being present in the file, but following the example could run a compromised future release with access to user-level agent skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The custom-directory usage example selects no fixed package version, so its executed code can change without a documentation change. A compromised release could run arbitrary code with the installing user's privileges, regardless of the requested destination.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The global-install example executes an unpinned npm package and intentionally targets multiple agents' skill directories. If a future release is compromised, this workflow could distribute malicious skill content across multiple agent installations.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The default-install example executes whichever release the registry resolves rather than a reviewed fixed version. A compromised release could execute arbitrary code and alter project-level agent skills; the current installer's safeguards cannot constrain replacement package code.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Even the list-only example starts an unpinned npm executable before processing the --list flag. The supplied installer only prints directories on that path, but a compromised future release would not be bound by that behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The --dry-run flag controls the supplied installer's behavior but does not prevent npx from executing an unpinned package. A compromised release could ignore that flag and perform arbitrary filesystem operations with user privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The version example still executes the npm package entry point, and no reviewed version is specified. Although the supplied code only reports a version on this path, a compromised registry release could execute malicious code before or instead of doing so.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

Requesting help through npx still executes the unpinned package's entry point. The help flag is not a sandbox, so a compromised future release could execute arbitrary code despite the apparently informational operation.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-security-testing'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command executes an unpinned npm package, and -y suppresses the installation confirmation. A compromised or malicious future package release could execute code with the installing user's privileges; this is a supply-chain exposure, although the source does not establish that the package is an MCP server.

Content

No source excerpt is available for this finding.

The trigger “帮我看这个站” (“help me look at this site”) can activate security testing for requests that do not ask for it.

Medium

• Category: Trigger Abuse
• Confidence: 92% confidence

Finding

This phrase can also describe ordinary requests to review a site's content, appearance, or usability. Although the paragraph identifies the skill as an active-testing methodology, it includes this ambiguous invocation without excluding non-security website reviews; authorization checks do not resolve that intent ambiguity.

Content

No source excerpt is available for this finding.

Tainted flow: 'cfg_dir' from os.environ.get (line 439, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/yotta_security_testing.py (reported line 179)May include surrounding context.

python

entry = {"ts": now_iso(), "tool": TOOL_NAME, "version": VERSION,
             "action": action}
    entry.update(fields)
    with open(audit_path(cfg_dir), "a", encoding="utf-8") as f:
        f.write(json.dumps(entry, ensure_ascii=False) + "\n")
    return entry

Report generation can reproduce executable payloads despite the manifest's explicit no-payload-output boundary.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The manifest and module documentation at L019 promise not to output executable payloads. However, L699–L710 reproduce supplied descriptions and evidence, while the preprocessing at L755 only redacts credentials; executable exploit content in those fields can therefore be emitted unchanged into Markdown reports.

Content

No source excerpt is available for this finding.

Scan metadata bypasses credential redaction despite documentation claiming reports redact sensitive credentials.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Finding objects pass through redact_value, but scans metadata is passed unchanged into JSON output and selected scan fields are interpolated directly into Markdown. Credentials in scan references or other metadata can therefore leak when reports are shared, despite the report's assurance that sensitive credentials have been redacted.

Content

No source excerpt is available for this finding.