ClawHub
Back to skill

Security audit

元审 yotta-vetter

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed local security-review helper, with expected installer and scanner behavior that is proportionate to its purpose.

Install only from a source you trust, prefer a pinned package version or reviewed release, and use --agent or --dir deliberately. When running checks, point it at the specific skill directory you want reviewed rather than a broad home or project tree containing unrelated private files.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (60)

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
If the associated implementation actually installs or copies files into agent skill directories while presenting itself as a passive security vetting tool, that is a serious description-behavior mismatch. Users may invoke it expecting analysis only, but it could modify trusted skill locations and change agent behavior, undermining informed consent and enabling supply-chain style abuse.

Tp4

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding
If the associated implementation actually installs or copies files into agent skill directories while presenting itself as a passive security vetting tool, that is a serious description-behavior mismatch. Users may invoke it expecting analysis only, but it could modify trusted skill locations and change agent behavior, undermining informed consent and enabling supply-chain style abuse.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
install_to() {
  mkdir -p "$1/$SKILL_NAME"
  cp -r "$SOURCE_DIR/." "$1/$SKILL_NAME/"
  rm -rf "$1/$SKILL_NAME/.git"
  echo "installed -> $1/$SKILL_NAME"
}
Confidence
95% confidence
Finding
The script uses rm -rf on a path derived from user-controlled input (--dir) with no canonicalization or guardrails. While the appended subpath limits obvious arbitrary deletion, force-recursive deletion in installer code is still dangerous because malformed, unintended, or symlink-influenced targets can remove data the user did not expect to be touched.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def run_cli(args, env=None):
    full = dict(os.environ)
    if env:
        full.update(env)
    return subprocess.run(
Confidence
60% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
def run_cli(args, env=None):
    full = dict(os.environ)
    if env:
        full.update(env)
    return subprocess.run(
Confidence
60% confidence
Finding
Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Credential Access

High
Category
Privilege Escalation
Content
"Python 归档后上传", 85),
    Rule("EXF-003", "Exfiltration", "high",
         r"(?i)(?:\.env[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib)|(?:\bcurl\b|\bwget\b|requests\.post|urllib)[^\n;]{0,80}\.env)",
         "读取 .env 后外传", 88),
    Rule("EXF-004", "Exfiltration", "high",
         r"(?i)(?:(?:id_rsa|id_ed25519|\.ssh)[^\n;]{0,80}(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)|(?:\bcurl\b|\bwget\b|requests\.post|urllib|ftp)[^\n;]{0,80}(?:id_rsa|id_ed25519|\.ssh))",
         "读取 SSH 私钥后外传", 92),
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
r"(?i)osascript[^\n;]{0,120}(?:password|passphrase)",
         "macOS 弹窗套取密码", 90),
    Rule("CRE-002", "CredentialTheft", "critical",
         r"(?i)security\s+find-generic-password|keychain",
         "访问 macOS keychain 凭据", 85),
    Rule("CRE-003", "CredentialTheft", "high",
         r"(?i)(?:id_rsa|id_ed25519|id_dsa)\.?(?:pub)?\b",
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tool Parameter Abuse

High
Category
Tool Misuse
Content
# ── PrivilegeEscalation 权限提升 ──────────────────────────────────────
    Rule("PRI-001", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+[0-7]*[267][0-7]{2}\b",
         "chmod 设置 setuid/setgid/sticky 权限位", 85),
    Rule("PRI-002", "PrivilegeEscalation", "high",
         r"(?i)\bchmod\s+777\b",
         "chmod 777 全权限", 70),
Confidence
90% confidence
Finding
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Credential Access

High
Category
Privilege Escalation
Content
".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
    ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
    ".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
    ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
    ".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
".md", ".txt", ".yaml", ".yml", ".json", ".toml", ".ini", ".cfg",
    ".rb", ".go", ".rs", ".java", ".c", ".cpp", ".h", ".hpp",
    ".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}
Confidence
80% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
".html", ".css", ".xml", ".svg", ".plist", ".ps1", ".bat", ".cmd",
    ".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}
Confidence
80% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
".env", ".conf", ".properties", ".gradle",
}
DOTFILE_NAMES = {".env", ".env.example", ".netrc", ".pgpass", ".bashrc",
                 ".zshrc", ".profile", ".bash_profile", ".npmrc", ".gitconfig"}
SCRIPT_EXTENSIONS = {".py", ".js", ".ts", ".mjs", ".cjs", ".sh", ".bash", ".zsh",
                     ".ps1", ".bat", ".cmd", ".rb", ".pl"}
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Natural-Language Policy Violations

Medium
Confidence
93% confidence
Finding
This markdown explicitly documents language constraints: README is forced to English while SKILL trigger descriptions are kept in Chinese. Under the policy, fixed language requirements should either offer user choice or clearly justify the locale constraint; this file documents neither.

Rp1

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The activation text is broad and catch-all, including phrases like any scenario where 'unknown code is about to be installed' and multiple generic trigger terms. Overbroad activation can cause unintended invocation, increasing the chance the skill runs in contexts the user did not explicitly intend, potentially exposing local paths or causing confusing automated actions.

Unsafe Defaults

Medium
Category
Tool Misuse
Content
|---|---|---|
| 1. Source | Source platform, author reputation, stars / last-updated, license | source github:owner/repo; references/checklist.md |
| 2. Code | SKILL.md integrity, script inventory, dangerous-pattern rule scan | check <path> |
| 3. Permissions | Executable bits, world-writable, symlinks, read/write/network scope | check <path> |
| 4. Risk | Risk-level verdict + conclusion + decision record | Verdict / decision-record sections of the report |

## Verdict matrix
Confidence
70% confidence
Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.

Skill Enumeration

Medium
Category
Agent Snooping
Content
```text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-vetter --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-vetter --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)
```
Confidence
85% confidence
Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium
Confidence
93% confidence
Finding
L010 将触发范围描述为“检测到安装/评估任何技能前”“任何‘要装未知代码’的场景”，并列出非常宽泛的词语如“审查”“检查技能”。这类表述缺少明确边界、限定上下文或反例，容易与普通安全讨论或一般性求助重叠，造成非预期激活。

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-vetter` without pinning a specific package version. That means installation will fetch whatever version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installer command for a skill, users may execute it directly with high trust.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-vetter` without pinning a specific package version. That means installation will fetch whatever version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installer command for a skill, users may execute it directly with high trust.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding
The README instructs users to run `npx -y @yottameta/yotta-vetter` without pinning a specific package version. That means installation will fetch whatever version is current at execution time, creating a supply-chain risk if a malicious or compromised release is published later. Because this is an installer command for a skill, users may execute it directly with high trust.

Static analysis

No suspicious patterns detected.