Real Skill packageSource verifiedClawHub registry

元安全 yotta-agent-hardening

元安全 —— 给 AI 智能体 / Agent 技能自身做「体检 + 加固建议」：按 提示注入防护 / 工具调用边界 / 数据隔离 三域，对安装的 skills、MCP 服务器、工具描述、权限与数据读取面做配置面静态加固扫描，输出加固报告与可执行防御守则（零依赖 Python 3.8+，扫描只读、敏感读取检测默认开启、报告用「类」表述、每次扫描默认留痕）。触发：用户要求给智能体或技能环境做安全体检 / 加固、检查 MCP 服务器或技能是否可信、排查提示注入 / 越权 / 数据泄露风险、想了解装了一堆技能后的整体暴露面；或用户说 元安全 / 加固 / 安全体检 / 体检 / hardening / 扫一下我的技能 / 检查 MCP / 防御守则 / guardrails 等。边界（Do NOT trigger）：不产出可复制注入串 / 攻击 payload；只扫描用户自有、有权检查的目录与配置，不扫描无权访问的环境；不做运行时拦截（那是元盾）；不做单个技能装前审核（那是元审 / 元信）；不替代人工安全审计与最终决策。

Identity and source

Publisher attributionYottaMetaregistry owner unverified by skillvetai
Functional categoryAgent Engineering, Security & Governanceautomatically inferred · 80% rule confidence
Package forminstruction with code18 recorded files
Canonical sourceClawHub registryclawhub:yottameta:yotta-agent-hardening
Open canonical source ↗

Platform declarations

These states come from the source or distribution context. None of the entries below are SkillVetAI compatibility test results.

OpenClawnative officialProvenance: registry distribution

Independent structural checks

These checks parse the fixed package against dated platform rules. They do not execute the Skill or verify task behavior.

Claude Codepasses structure
Checker 0.1.0 · agent-skills-2026-08-13+claude-code-docs-2026-08-13 · 8/30/2026.claude/skills/yotta-agent-hardening

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

OpenAI Codexpasses structure
Checker 0.1.0 · agent-skills-2026-08-13+codex-docs-2026-08-13 · 8/30/2026.agents/skills/yotta-agent-hardening

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

OpenClawpasses structure
Checker 0.1.0 · agent-skills-2026-08-13+openclaw-docs-2026-08-13 · 8/30/2026skills/yotta-agent-hardening

Runtime, accounts, dependencies, permissions, network behavior and task quality remain untested.

Installation and inspection

This command is recorded from the source ecosystem and resolves the registry's latest release. The fixed release shown on this page should be inspected before adoption.

clawhub install @yottameta/yotta-agent-hardening
clawhub inspect @yottameta/yotta-agent-hardening --version 0.2.4

Security evidence

SkillVetAI static result: high signal

This automated, non-executing scan is bound to this release hash. It is not a safety certification and may contain false positives or false negatives.

Status
completed
Coverage
full text content
Files
16 / 18 inspected as text
Checked
8/30/2026, 5:23:23 AM
Scanner
0.1.3
Policy
1.0.3
2 automated findings
highRemote content is piped directly to a shellscripts/hardening_rules.py:340 · confidence 98%wget|powershell
mediumWorld-writable permissions are requestedscripts/hardening_rules.py:233 · confidence 95%chmod 777
1 High/Critical review queue entry
STATIC_DOWNLOAD_PIPE_TO_SHELLpending
Open human review queue →
5 inferred permission indicators
  • shell execution — automatically inferred
  • network access — automatically inferred
  • filesystem read — automatically inferred
  • filesystem write — automatically inferred
  • credential access — automatically inferred
8 dependency and API indicators
  • api: agentskills.io
  • api: clawhub.ai
  • api: evil.example
  • api: github.com
  • api: img.shields.io
  • api: registry.npmjs.org
  • api: www.npmjs.com
  • api: x.example
External clawhub result: clean

This is registry-supplied evidence for the recorded release, not an independent SkillVetAI scan. Check the canonical source for the full report, scanner versions, scope, and current moderation state.

Evidence checked
8/30/2026, 4:08:06 AM
Release binding
Matches this record
  • vt: clean
  • skillspector: suspicious
  • llm: clean

Recorded files

The catalog stores hashes and an inventory summary for change detection. It does not republish the package contents.

Package content hashsha256:783b9fc420fdb16ca8f6b3d107c9f2df0118a7341d359a3e5c86922efb44cf09
Show up to 18 recorded paths
  • assets/banner.png
  • bin/install.js
  • CHANGELOG.md
  • install.sh
  • LICENSE
  • NOTICE
  • package.json
  • README.md
  • README.zh-CN.md
  • references/detection-items.md
  • references/guardrails-template.md
  • references/report-template.md
  • references/tutorial.md
  • scripts/hardening_rules.py
  • scripts/test_yotta_agent_hardening.py
  • scripts/yotta_agent_hardening.py
  • skill-card.md
  • SKILL.md

Source changelog

yotta-agent-hardening v0.2.4 - Updated references/report-template.md to refine hardening report templates and content structure. - Minor text and markdown improvements in documentation files (SKILL.md, references/guardrails-template.md). - Bumped version and dependencies in package.json. - Small bug fixes and enhancements in scripts (test_yotta_agent_hardening.py, yotta_agent_hardening.py). - Improved changelog maintenance (CHANGELOG.md updated).