Security audit
Security checks for vulnerabilities and agentic risk
This skill manager needs review because health checks can execute untrusted scripts and crafted skill imports can write outside the selected folder.
Prefer a release that fixes doctor authorization and import containment. Until then, avoid doctor on untrusted directories and adoption of unreviewed external skills. Pin the installer version and review target directories before changes. The scanner was partial; sensitive entrypoints were independently investigated, but downloaded skill packages and every bundled code path were not audited.
bin/yotta-skills.jsDoctor executes project-controlled scripts based on a self-declared trust label
Arbitrary code execution as the user running doctor, including access to that user's files and inherited environment. A later failed health result cannot undo execution.
lib/hub-adopt.jsExternal skill frontmatter can redirect adoption outside the selected Hub
An external skill can place its directory contents outside the Hub wherever the invoking user can write. If force is enabled, an existing external target can also be moved to trash and replaced. Existing non-link targets are otherwise protected by the force requirement.
Referenced artifact was not completely inspected
6. **判断标准**：技能目录有对应 `SKILL.md` 即视为已装；拿不准 → 视为未装并给提示。
Referenced artifact was not completely inspected
`SKILL.md` frontmatter，生成/更新本地注册表 `~/.yottaskills/registry.json`，数据不出本机。
Referenced artifact was not completely inspected
（对 npm `dist-tags.latest`），按本地 `SKILL.md` 版本对比——无论技能源自哪个安装渠道
Referenced artifact was not completely inspected
`doctor` 是只读自检，不会修改技能目录或注册表。它检查目标技能目录、`SKILL.md`、
Referenced artifact was not completely inspected
后者会按 `SKILL.md` / `skill-manifest.json` 自动识别技能身份。`--json` 返回稳定字段，
Referenced artifact was not completely inspected
包内 `SKILL.md` 与 `skill-manifest.json` 身份一致（slug / package / trust / 版本）、
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
ect.keys(state.selected).filter(function (k) { return state.selected[k]; }).length;\n $('#adoptCount').textContent = String(n);\n $('#adoptApply').disabled = n === 0;\n }\n $('#adoptSearch').addEventListener('input', function (e) { state.adoptFilter = e.target.value; renderAdopt(); });\n $('#adoptList').addEventListener('change', function (e) {\n var box = e.target.closest('input[data-slug]');\n if (!box) return;\n if (box.checked) state.selected[box.dataset.slug] = true; else delete state.selected[box.dataset.slug];\n updateAdoptCount();\n });\n $('#adoptAll').onclick = function () {\n ((state.adopt && state.adopt.candidates) || []).forEach(function (c) { if (!c.inHub) state.selected[c.slug] = true; });\n renderAdopt();\n };\n $('#adoptNone').onclick = function () { state.selected = {}; renderAdopt(); };\n $('#adoptApply').onclick = function () {\n var slugs = Object.keys(state.selected).filter(function (k) { return state.selected[k]; });\n if (!s
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
// ── 4. ledger（定向清台账；不调 syncHubState） ──────────────────────────
const state = readHubState(hubDir);
if (state.skills && state.skills[slug]) {
delete state.skills[slug];
writeHubState(hubDir, state);
}
const linkState = readLinkState(hubDir);
Model output is used without validation or sanitization. Unvalidated output injected into downstream contexts (SQL, shell, HTML) enables injection attacks and arbitrary code execution.
\"mono\">' + esc(preview) + '</div>', '开始收编', false, async function () {\n var r = await api('/api/adopt/apply', { body: { include: slugs } });\n if (r.error) { toast(r.error); return; }\n closeModal();\n var order = { imported: 0, blocked: 1, conflict: 2, skip: 3, error: 4 };\n var results = (r.results || []).slice().sort(function (a, b) { return (order[a.status] || 9) - (order[b.status] || 9); });\n $('#adoptResultsWrap').hidden = false;\n $('#adoptResults').innerHTML = results.map(function (x) {\n var tone = x.status === 'imported' ? 'ok' : x.status === 'error' || x.status === 'blocked' ? 'danger' : 'warn';\n return '<div class=\"result\"><span class=\"badge ' + tone + '\">' + esc(x.status) + '</span><b>' + esc(x.slug) + '</b><span>' + esc(x.note || '') + '</span>' + (x.scanVerdict ? '<span class=\"faint\">verdict: ' + esc(x.scanVerdict) + '</span>' : '') + '</div>';\n }).join('');\n toast('收编完成：导入 ' + (r.summary ? r.summary
Both the configured host and the listen-time host can select a non-loopback interface despite the loopback-only security claim. When exposed, a direct HTTP client can retrieve sensitive read APIs and the HTML containing the write token, then invoke destructive operations; Host, Origin, and Fetch-Site checks do not authenticate such clients.
Missing, malformed, or empty scanner designations become an empty array, which bypasses the scanner-membership restriction and permits a matching allow exception to suppress findings. Version and tree-hash checks constrain which package can receive the exception, but do not enforce the documented scanner scope; suppressing a critical finding can change an installation-blocking verdict to a permissive one.
L011-L013 and L128 promise that a trusted installation record is mandatory and its absence fails closed. L134 returns successful package inspection when requireRecord is false, bypassing both recorded-path and digest validation; inspectPackage explicitly performs only package-shape checks, not trust determination (L073-L076).
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
the registry afterwards, and <code>--reindex</code> re-scans on demand. An optional <code>yotta-skills</code> MCP (on-demand, not resident) exposes <code>list_installed_skills</code> / <code>describe_skill</code> / <code>reindex</code> / <code>route_request</code> / <code>decide_memory</code>; see <code>SKILL.md</code> for the config.
- **No silent writes** - 元阁 only suggests. Installing skills, adding a client <code>mcpServers</code> entry, and writing an agent's global memory each require explicit user confirmation beforehand; declining never blocks the plain CLI workflow.
Boundaries: it only downloads, places, gates and summarizes — it does **not** develop skill content, does **not** bundle any skill body, does **not** use <code>-g</code> global installs, and does **not** silently write host configuration or agent global memory. Besides the target directory, it keeps its registry, snapshots, install evidence and update-check cache under <code>~/.yottaskills</code>.
## Usage cases
The documented npx command can fetch and execute an unpinned installer release with the user's privileges. This is a supply-chain exposure rather than a demonstrated MCP vulnerability; pinning downloaded skills does not pin the installer itself.
The host-discovery example launches an unpinned npm executable. Even a nominally read-only command executes the fetched package first, so a compromised future release could run arbitrary code.
The Hub installation example executes an installer selected through a mutable npm release tag. A compromised installer could alter the shared skill source before any package-scanning safeguards apply.
The linking command executes an unpinned npm package before performing its requested operation. Its cross-host distribution role increases the potential reach of a compromised release, although no compromise is demonstrated.
Opening the local panel through unversioned npx can execute a newly published, unreviewed package. The issue is executable supply-chain drift, not evidence that the panel or an MCP server is malicious.
The standalone-install example executes an unpinned installer and then persists its files locally. A compromised release could therefore execute immediately and leave a compromised local installation.
Choosing an explicit installation directory does not constrain which npm release npx executes. A compromised mutable release could run with the user's permissions regardless of the requested destination.
The location-inspection command still starts an unpinned executable from npm. Its informational purpose does not prevent arbitrary behavior if the fetched release is compromised.
The list example invokes unpinned npx despite its 'no network, no changes' annotation. The CLI operation may be offline, but npx can first fetch and execute a mutable package release.
The direct agent-install example executes an unpinned installer with access to user-level skill directories. A compromised installer could tamper with future agent instructions, and its own verification gate would not establish trust in the installer.
This directory-install example uses a mutable installer release. An attacker controlling a later package release could execute code before the intended download and placement operations.
Selecting only two skills limits intended installation scope but does not pin the executable installer. A compromised CLI release could ignore that scope and execute with the user's privileges.