Security audit
Security checks for vulnerabilities and agentic risk
The skill is mainly a scaffold generator, but its bundled installers can persist the skill into many agents' skill directories without confirmation.
Review the installer behavior before installing. Prefer a specific --agent or --dir target, avoid -g/--global unless you truly want this skill installed for every listed agent, and consider pinning the npm version. Also note that the packaged full scaffold appears incomplete because required hidden template files are absent, so full-mode creation may fail self-check until the package is fixed.
{
"name": "@yottameta/yotta-skill-creator",
"version": "0.1.0",
"description": "YuanZao (元造) — a zero-dependency Python 3.8+ skill scaffold generator: validates naming (yotta- prefix / lowercase-hyphen / YuanX Chinese name / non-overwrite), renders a full release-compliant scaffold from an embedded template (SKILL.md, bilingual four-way-install README, package.json, CHANGELOG, LICENSE, NOTICE, install.sh + bin/install.js, .gitignore, .npmignore, publish.yml, references, assets), replaces placeholders and runs a structure self-check; --self-use mode generates only the skill body (SKILL.md / references / optional CLI) without any release artifacts. Triggers: creating a new yotta- skill, scaffolding a skill from scratch, or fixing release-standard pitfalls into a reusable template; or when the user says 元造 / 造技能 / 脚手架 / scaffold / 新建技能. Boundaries: it does not write skill content or script logic (SKILL.md body / scripts need manual development), does not pre-publish validate or release (that is yotta-publish-guard), and does not batch-migrate existing skill directories.",
"license": "MIT",
"keywords": [
"agent-skills",install_to() {
mkdir -p "$1/$SKILL_NAME"
cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
rm -rf "$1/$SKILL_NAME/.git"
echo "installed -> $1/$SKILL_NAME"
}install_to() {
mkdir -p "$1/$SKILL_NAME"
cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
rm -rf "$1/$SKILL_NAME/.git"
echo "installed -> $1/$SKILL_NAME"
}| 元造 yotta-skill-creator (this skill) | **Create**: compliant scaffold + structure self-check | | 元守 yotta-publish-guard | **Guard**: pre-publish check / pack / versions / names / publish | Recommended flow: **元造 create (scaffold) → develop the skill body / scripts / tests → 元守 check → pack → versions → names → publish**. References: `references/tutorial.md` (Chinese tutorial), `references/cli-reference.md` (full CLI reference), `references/scaffold-structure.md` (generated layout).
```text # Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-skill-creator --agent <agent-name> # install to the agent's default user-level skills dir npx -y @yottameta/yotta-skill-creator --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills) ```
No suspicious patterns detected.