Security audit
Security checks for vulnerabilities and agentic risk
The skill’s malware-triage engine is coherent and local, but its bundled installers can copy agent-executable skill files into multiple assistant skill directories without confirmation.
Install only into the specific assistant skill directory you intend to use, preferably with an explicit --dir path. Avoid the global or no-argument installer modes unless you want this skill available across multiple agents, and consider pinning the npm version before running npx. The triage engine itself should still be used only on files and directories you are authorized to analyze.
install_to() {
mkdir -p "$1/$SKILL_NAME"
cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
rm -rf "$1/$SKILL_NAME/.git"
echo "installed -> $1/$SKILL_NAME"
}def run_cli(*args):
"""以子进程方式运行 CLI（Windows 下也保证 UTF-8 输出）。"""
env = dict(os.environ)
env["PYTHONIOENCODING"] = "utf-8"
return subprocess.run(
[sys.executable, SCRIPT] + list(args),```text # Optional China mirror: npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-triage --agent <agent-name> # install to the agent's default user-level skills dir npx -y @yottameta/yotta-triage --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills) ```
```text # 可选国内加速：npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-triage --agent <智能体名称> # 装到指定智能体默认用户级技能目录 npx -y @yottameta/yotta-triage --dir <智能体的技能目录> # 指到技能目录本身（如 ~/.codex/skills） ``` - `--agent <name>` 自动装到该智能体默认用户级目录；`--list` 可查看各智能体默认目录。
```text # 可选国内加速:npm config set registry https://registry.npmmirror.com npx -y @yottameta/yotta-triage --agent <智能体名称> # 装到指定智能体默认用户级技能目录 npx -y @yottameta/yotta-triage --dir <智能体的技能目录> # 指到技能目录本身(如 ~/.codex/skills) ``` - `--agent <name>` 自动装到该智能体默认用户级目录;`--list` 可查看各智能体默认目录。
const AGENT_DIRS = {
claude: { label: 'Claude Code', dirs: ['.claude/skills'] },
cursor: { label: 'Cursor', dirs: ['.cursor/skills', '.agents/skills'] },
codex: { label: 'Codex', dirs: ['.codex/skills'] }, // 特判：$CODEX_HOME/skills
gemini: { label: 'Gemini CLI', dirs: ['.gemini/skills', '.agents/skills'] },
goose: { label: 'Goose', dirs: ['.config/goose/skills', '.agents/skills'] },
amp: { label: 'Amp', dirs: ['.config/agents/skills', '.agents/skills'] },Detected: suspicious.obfuscated_code