ClawHub
Back to skill

Security audit

元序 yotta-workflow

Security checks for vulnerabilities and agentic risk

Overview

This skill provides disclosed, project-scoped progress tracking, with optional installers whose behavior fits that purpose.

Use the version-pinned installation command and select a specific agent or directory; choose --global only if you want installation across agents. Expect automatic project logs and Chinese handoff labels, and review records before sharing them. All 13 bundled files were inspected, including both scripts affected by scanner gaps. Host hook enforcement and externally downloaded package contents were not verified.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (15)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The supplied chunk implements skill deployment rather than project-state persistence: it neither reads nor updates .workflow nor implements session recovery or handoff tracking. Although an installer can support distribution of the described workflow, its substantive filesystem operations across agent installation directories are not disclosed in the description. The cleanup is scoped and includes symlink safeguards; there is no visible network access or exfiltration. The mismatch concerns undeclared installation and maintenance behavior, not evidence of malicious activity.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
85% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

text
# Optional China mirror: npm config set registry https://registry.npmmirror.com
npx -y @yottameta/yotta-workflow@0.4.5 --agent <agent-name>      # install to the agent's default user-level skills dir
npx -y @yottameta/yotta-workflow@0.4.5 --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The mandatory handoff format forces Chinese-language output without user language choice.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The skill requires agents to output the Chinese handoff template verbatim and mandates the Chinese title “给你的下个会话锚点” consistently across all projects and sessions. This is an output-language requirement, not merely documentation written in Chinese, and no user opt-in or locale-specific justification is provided.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The recommended installation example uses npx -y without a package version, allowing execution of a changing registry release without an interactive installation prompt. If a future release or publisher account is compromised, following this example could execute attacker-controlled code with the user's privileges; this is an installer supply-chain risk, not an MCP-server configuration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The custom-directory installation example resolves an unpinned npm release and executes its installer. Choosing a destination with --dir does not sandbox that executable, so a compromised future release could act with all of the invoking user's permissions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
91% confidence
Finding

This example executes an unpinned npm package and requests installation across all known user-level agent directories. A compromised release could execute arbitrary code, while the broad installation mode also increases the reach of malicious skill content across agents.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The default installation example executes whichever package release the registry currently resolves rather than a reviewed fixed release. A compromised future version could run arbitrary code and distribute malicious skill files into detected project-level agent directories.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Although --list is read-only in the supplied installer, npx first obtains and executes the unpinned package's entry point. A compromised future release need not honor --list and could execute arbitrary code before displaying any directory information.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding

The --dry-run option prevents writes in the supplied installer, but it does not prevent npx from executing an unpinned package. A compromised future release can ignore dry-run semantics, so the example does not provide a safe preview boundary.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

Requesting --version still causes npx to execute the unpinned package's entry point. A compromised registry release could run attacker-controlled code even though the user only intended to inspect a version.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx -y @yottameta/yotta-workflow'.

Medium
Category
MCP Rug Pull
Confidence
89% confidence
Finding

The --help example downloads and executes a mutable package release rather than merely reading static documentation. A compromised future release could perform arbitrary actions regardless of the informational argument.

Content

No source excerpt is available for this finding.

The startup hook can activate on the first user input without a clearly defined project-workflow scope.

Medium
Category
Trigger Abuse
Confidence
90% confidence
Finding

The condition says “when a project-type session starts or at the first user input.” The first-input alternative is not explicitly restricted to project-workflow sessions, and “project-type session” is undefined, allowing activation during unrelated conversations. Because the hook uses a blocking failure policy, unintended activation could also interrupt those conversations.

Content

No source excerpt is available for this finding.