Security audit
Security checks for vulnerabilities and agentic risk
This scanner needs review because certain scan targets can execute untrusted code despite its promise to inspect files without running them.
Prefer the bundled Python scanner on existing local directories. Avoid npm/Git target retrieval until it is restricted to script-free registry downloads. Pin and review any npm version used to launch the server. Preview installer changes with --dry-run and back up an existing installation. Check the actual scan report rather than trusting an audited badge. The scanner's partial-coverage files were independently inspected; external releases and runtime containment were not verified.
scripts/yotta_verify_mcp.pyUnrestricted npm pack targets can execute unreviewed lifecycle scripts
A malicious repository can execute arbitrary commands with the scanner process's permissions, including accessing local secrets or modifying user files. The temporary output directory and 120-second timeout do not sandbox those commands.
Network retrieval and temporary files are disclosed elsewhere, but the reported unrestricted npm pack invocation presents a separate risk. If untrusted targets can select local or Git package sources with applicable lifecycle hooks, scanning may execute code before evaluating it, directly defeating the scanner's core safety boundary; registry tarball retrieval alone does not establish that execution occurs.
The reported write-by-default installer and undisclosed deletion behavior undermine the promised explicit-consent boundary and can overwrite or remove existing agent files. Accepting but ignoring --yes also suggests that confirmation is not meaningfully enforced, although the underlying code is unavailable for verification.
The static finding reports persistent installation, overwrites, and deletion outside the advertised scanning scope without an enforced consent boundary. If reachable as reported, this can alter agent behavior or destroy existing installation content despite the documentation's explicit no-write-before-consent promise; the implementation was not supplied for independent verification.
The scanning functionality substantially matches the declared security purpose, and the visible code contains no network requests or execution of inspected code. However, scan_core calls tempfile.mkdtemp and extracts archive contents without a consent check, contradicting the description's unconditional pre-consent no-write boundary. Output-writing commands likewise contain no separate consent mechanism, although explicitly requesting those outputs could constitute consent. The MCP interface is not implemented in this file; a separate wrapper could supply it, so its absence is a limitation of the supplied evidence rather than proof that the entire skill lacks MCP support.
Launching the Python server and checking Python availability are supporting implementation details consistent with the description. However, routing installation flags to install.js exposes a separate skill-installer capability not disclosed by the stated scanner/MCP purpose; optional MCP configuration is not the same as skill installation. The installer and Python server implementations are absent, so this chunk does not establish whether files are written without consent, networking occurs, or the four advertised tools are implemented.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"Python 归档后上传", 85),
Rule("EXF-003", "Exfiltration", "high",
r"(?i)(?:\.env[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib)|(?:\bcurl\b|\bwget\b|requests\.post|urllib)[^\n;]{0,80}\.env)",
"读取 .env 后外传", 88),
Rule("EXF-004", "Exfiltration", "high",
r"(?i)(?:(?:id_rsa|id_ed25519|\.ssh)[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)|(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)[^\n;]{0,80}(?:id_rsa|id_ed25519|\.ssh))",
"读取 SSH 私钥后外传", 92),
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"数据外传指令（中文）", 80),
Rule("PIJ-013", "PromptInjection", "high",
r"(?i)(?:read|open|load)\s+[^\n]{0,60}\.env\b[^\n]{0,80}(?:send|upload|post|exfil|传|发)",
"读取 .env 后外传", 88),
# ── 分隔符逃逸 / 伪系统标签 ──────────────────────────────────────────
Rule("PIJ-014", "PromptInjection", "medium",
r"(?i)(?:<|\[|\{)?\s*(?:system|sysadmin)\s*(?:message|prompt|instruction|role)?\s*(?:>|\]|\})",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
"macOS 弹窗套取密码", 90),
Rule("CRE-002", "CredentialTheft", "critical",
r"(?i)security\s+find-generic-password|keychain",
"访问 macOS keychain 凭据", 85),
Rule("CRE-003", "CredentialTheft", "high",
r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
"macOS 弹窗套取密码", 90),
Rule("CRE-002", "CredentialTheft", "critical",
r"(?i)security\s+find-generic-password|keychain",
"访问 macOS keychain 凭据", 85),
Rule("CRE-003", "CredentialTheft", "high",
r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
"读取 SSH 私钥文件", 80),
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
"chmod 设置 setuid/setgid/sticky 权限位", 85),
Rule("PRI-002", "PrivilegeEscalation", "high",
r"(?i)\bchmod\s+777\b",
"chmod 777 全权限", 70),
Rule("PRI-003", "PrivilegeEscalation", "high",
r"(?i)\bsetuid\s*\(|setgid\s*\(",
"调用 setuid/setgid", 80),
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
("id_ed25519", "SSH 私钥", "high", 85),
("id_dsa", "SSH 私钥", "high", 85),
("credentials", "云服务凭据文件", "high", 80),
(".netrc", "网络凭据文件", "high", 80),
(".pgpass", "数据库口令文件", "high", 85),
("history", "shell 历史文件", "medium", 60),
(".env", "环境变量文件", "medium", 45),
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
r"(?i)(open\s*\([^)]*['\"]w|writeFileSync|appendFileSync|shutil\.copy|"
r"os\.rename|crontab\s+-e|>>\s*/etc|HKEY_.*Run|launchctl)")
PERM_READ_SENS_RE = re.compile(
r"(?i)(\.env\b|\.ssh|id_r[as]a|id_ed[12]55[0-9]|credentials\b|\.netrc|"
r"\.pgpass|keych[ai]n|DPAP[I1]|win32crypt)")
# base64 编码内容危险词（_check_base64 用）
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {
".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILE_SIZE = 1_000_000
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
(".netrc", "网络凭据文件", "high", 80),
(".pgpass", "数据库口令文件", "high", 85),
("history", "shell 历史文件", "medium", 60),
(".env", "环境变量文件", "medium", 45),
]
# ══════════════════════════════════════════════════════════════════════════
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {
".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {
".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILE_SIZE = 1_000_000
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
}
DOTFILE_NAMES = {
".env", ".env.example", ".netrc", ".pgpass", ".bashrc", ".zshrc",
".profile", ".bash_profile", ".npmrc", ".gitconfig",
}
MAX_FILE_SIZE = 1_000_000
MAX_LINE_LEN = verify_rules.MAX_LINE_LEN
The download path accepts arbitrary npm specifications rather than enforcing public registry packages. npm can prepare Git dependencies and execute their lifecycle code during packaging, allowing malicious code to run with the server's privileges before the supposedly non-executing security scan.
The documented package-name workflow downloads content despite the metadata and prominent claims describing a no-network scanner. Although the exception is disclosed here, an agent relying on the advertised boundary could initiate unauthorized network access and disclose package queries; these documents do not establish content upload or scanned-code execution.
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-verify-mcp --agent <agent-name> # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-verify-mcp --dir <your-skills-dir> # point to the skills dir itself (e.g. ~/.codex/skills)
The recommended installer executes an unpinned npm package with confirmation suppressed, so its code can change between invocations without review. A compromised future release could run with the user's permissions; a security scanner's offline scanning claims do not protect its installation process.
The custom-directory installation command executes the current npm release rather than a reviewed, fixed version. If that release is compromised, it can execute arbitrary code with user permissions, not merely write to the selected skills directory.
The documented server launch uses an unpinned package, allowing later launches to resolve code different from the version originally reviewed. A compromised release could execute with the MCP client's user privileges before any scan occurs.
The package-name parameter explicitly triggers npm retrieval, contradicting the metadata and prominent no-network assurances. The later disclosure reduces concealment but does not prevent an agent from crossing an expected offline boundary and exposing package queries; actual implementation behavior is not independently verified here.
The recommended installer executes an unpinned npm release with confirmation suppressed. A compromised future release could execute with user privileges, undermining the trust expected of a pre-install security scanner.