元审 yotta-vetter

• Outcome: Pass
• Latest audit: Nov 6, 2026 · 6:11 PM UTC
• Version: 0.2.9

Overview

The skill performs its disclosed security-review function, with no evidence of credential theft, hidden execution, or unrelated changes.

Choose a specific installation destination and pin a reviewed release when using npm. Scan untrusted packages in isolation, especially when they contain symlinks. Treat clean results as an initial check because some content is skipped and human review remains necessary. All bundled files were inspected, including the scanner's installer gaps; future npm releases and external tools are outside this assessment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (35)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 117)May include surrounding context.

python

"Python 归档后上传", 85),
    Rule("EXF-003", "Exfiltration", "high",
         r"(?i)(?:\.env[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib)|(?:\bcurl\b|\bwget\b|requests\.post|urllib)[^\n;]{0,80}\.env)",
         "读取 .env 后外传", 88),
    Rule("EXF-004", "Exfiltration", "high",
         r"(?i)(?:(?:id_rsa|id_ed25519|\.ssh)[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)|(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)[^\n;]{0,80}(?:id_rsa|id_ed25519|\.ssh))",
         "读取 SSH 私钥后外传", 92),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 130)May include surrounding context.

python

r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 131)May include surrounding context.

python

"macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
         "读取 SSH 私钥文件", 80),

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 183)May include surrounding context.

python

"chmod 设置 setuid/setgid/sticky 权限位", 85),
    Rule("PRI-002", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+777\b",
         "chmod 777 全权限", 70),
    Rule("PRI-003", "PrivilegeEscalation", "high",
         r"(?i)\bsetuid\s*\(|setgid\s*\(",
         "调用 setuid/setgid", 80),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 235)May include surrounding context.

python

("id_ed25519", "SSH 私钥", "high", 85),
    ("id_dsa", "SSH 私钥", "high", 85),
    ("credentials", "云服务凭据文件", "high", 80),
    (".netrc", "网络凭据文件", "high", 80),
    (".pgpass", "数据库口令文件", "high", 85),
    ("history", "shell 历史文件", "medium", 60),
    (".env", "环境变量文件", "medium", 45),

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vetter_rules.py (reported line 238)May include surrounding context.

python

(".netrc", "网络凭据文件", "high", 80),
    (".pgpass", "数据库口令文件", "high", 85),
    ("history", "shell 历史文件", "medium", 60),
    (".env", "环境变量文件", "medium", 45),
]

# ══════════════════════════════════════════════════════════════════════════

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_vetter.py (reported line 63)May include surrounding context.

python

".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
    ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
    ".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_vetter.py (reported line 65)May include surrounding context.

python

".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_vetter.py (reported line 65)May include surrounding context.

python

".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/yotta_vetter.py (reported line 66)May include surrounding context.

python

".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The changelog records a recommended installation command that executes an npm package without selecting a reviewed version. Although this is historical documentation rather than an MCP server configuration, copying the command can execute a subsequently compromised release with the user's privileges; its changelog placement reduces exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx --agent codex'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Unsafe Defaults

Medium

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Content

Scanner excerpt · README.md (reported line 52)May include surrounding context.

md

|---|---|---|
| 1. Source | Source platform, author reputation, stars / last-updated, license | source github:owner/repo; references/checklist.md |
| 2. Code | SKILL.md integrity, script inventory, dangerous-pattern rule scan | check <path> |
| 3. Permissions | Executable bits, world-writable, symlinks, read/write/network scope | check <path> |
| 4. Risk | Risk-level verdict + conclusion + decision record | Verdict / decision-record sections of the report |

## Verdict matrix

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 96)May include surrounding context.

text

# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-vetter --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-vetter --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended command uses npx -y to execute a package without pinning a reviewed version, allowing the resolved release to change over time. A compromised future release could execute with the user's privileges and install malicious agent instructions; this is a supply-chain weakness rather than an MCP-specific issue.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This alternative installation command also executes an unpinned npm release with automatic confirmation. Selecting a destination with --dir does not constrain the installer's execution privileges, so a compromised release could affect more than the specified skills directory.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The upgrade instructions explicitly recommend rerunning an unpinned command to obtain the latest release. This creates an opportunity to execute a newly compromised release without first reviewing it, which is especially consequential for software installed into an agent's skills directory.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The recommended installation command executes an npm package without specifying a reviewed version, and -y suppresses the installation confirmation. A compromised later release could therefore execute with the user's privileges before the security-review skill is available to assess it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The directory-based installation example executes an unpinned package, exposing users to changes in the registry's resolved release. The --dir option chooses where skills are installed but does not sandbox malicious installer code or prevent access to other user files.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The upgrade guidance directs users to overwrite their installation using the latest unpinned npm release. If the publishing account or release pipeline is compromised, this workflow could execute malicious code and replace trusted skill instructions.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-vetter'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.