ClawHub
Back to skill

Security audit

元鉴 yotta-triage

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised offline file analysis, with disclosed installation behavior and ordinary precautions for downloaded installers.

Choose a specific agent or installation directory and preview changes with --dry-run; upgrades overwrite this skill's installed files. If using npm, pin and verify the release because this assessment covers the bundled files, not future downloads. Analyze a dedicated sample directory, check file symlinks, and save reports separately from samples. Treat extracted strings as untrusted data and risk scores as preliminary clues.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (20)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied chunk is a deployment utility, not a static-analysis implementation: it contains no hashing, entropy calculation, IOC extraction, executable-header parsing, or triage-report generation. Installation can legitimately support the broader skill, but this script's entire primary behavior is deployment and modification of agent skill directories, which the declared purpose does not describe. Its cleanup is constrained and it includes path and symlink checks; no network access or sample execution is evident. This finding concerns the supplied installer, not whether unprovided components implement the advertised analysis.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The supplied chunk's primary purpose is installation and maintenance, not static sample analysis. Its filesystem modifications across agent skill directories are substantive behavior not represented in the declared description, rather than internal details of hashing or parsing samples. No hashing, entropy calculation, IOC extraction, executable-header parsing, or triage reporting is implemented here. This may be legitimate distribution tooling for a larger skill, but the supplied chunk does not match the stated analytical purpose. It contains no apparent networking or sample execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The changelog records a recommended npx installation command without an exact package version, allowing execution of whichever release the registry resolves at installation time. This creates a supply-chain risk if a future release or publisher account is compromised; the package is an installer, not an MCP server.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 120)May include surrounding context.

text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-triage --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-triage --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The recommended installation command uses npx -y without an exact version, automatically accepting execution of a registry-resolved package release. A compromised future release could execute with the installing user's privileges and modify agent skills; offline analysis restrictions do not protect the installation step.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The custom-directory installation command executes an unpinned npm package with automatic confirmation. A compromised registry-resolved release could run arbitrary code as the installing user, including modifying the chosen agent skills directory; this is an installer supply-chain risk rather than an MCP configuration issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The recommended npx command automatically executes the package without fixing its version. A compromised future release or publisher account could therefore introduce code execution during installation, independently of the tool's stated offline analysis behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The custom-directory command uses an unpinned package and suppresses npx confirmation with -y. If the resolved release is compromised, its installer runs with the user's privileges and could alter agent skills or other accessible files.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-triage'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/triage-spec.md (reported line 54)May include surrounding context.

md
- 域名：多段标签 + 末段 ≥2 字母；**非 TLD 后缀黑名单**（exe/dll/py/js/txt/md/zip/png…）过滤，避免 payload.exe / a.exe 误判。
  - IP：IPv4 四段 0-255 校验。
  - 邮箱：标准 user@domain.tld。
  - 可疑命令：关键字正则（powershell -enc / certutil -urlcache / bitsadmin /transfer / regsvr32 /s /i / mshta / rundll32 / schtasks /create / cmd /c / iex / Invoke-WebRequest / curl / wget / downloadstring / base64 -d / Assembly.Load / wscript / cscript / -windowstyle 等）。
  - 路径：Windows 盘符路径、UNC、%ENV% 路径、/etc /tmp /var /usr /bin /dev、Windows\System32、AppData、Users 等。
  - base64：≥60 字符的 base64 字符集连续段。

Risk explanations are fixed to Chinese without user language opt-in.

Low
Category
Output Handling
Confidence
91% confidence
Finding

The description specifies that every risk hint includes reasons in Chinese, without offering an output-language choice or justifying a locale restriction. The English/Chinese README links provide documentation choices, not control over the language of generated reports.

Content

No source excerpt is available for this finding.