@yottameta/yotta-verify-mcp-plugin 0.4.1 → 0.4.2

package/.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.1",
+      "version": "0.4.2",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-verify-mcp-plugin",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "YuanXinMCP (元信MCP) — pre-install security scanning for Agent skills, packaged as a YottaMeta Agent Plugin.",
   "license": "MIT",
   "keywords": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "yotta-verify-mcp",
-  "version": "0.4.1",
+  "version": "0.4.2",
   "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
   "author": {
     "name": "YottaMeta",

package/skills/yotta-verify-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-verify-mcp
 description: 元信MCP（yotta-verify-mcp）—— 把元信（yotta-verify）装前安全扫描暴露为 stdio MCP server，提供 scan_skill（目录/包 → verdict+发现）、generate_badge（audited 徽章）、gate_check（CI 闸门）、get_report（JSON/Markdown 双视角综合报告）四个 MCP 工具。触发：给 MCP 客户端配置元信MCP、把装前信任扫描接入智能体/工作流、调用上列 MCP 工具做扫描；或用户说 MCP元信/元信MCP/trust-mcp/scan-mcp 等。边界：本地离线静态扫描，不上传被测内容、不执行被测代码、不联网；结论需人工确认。MCP 配置与全局/永久记忆写入均为可选，必须先获得用户明确同意；未获同意前不写任何文件，可直接降级 CLI。
-version: 0.4.1
+version: 0.4.2
 license: MIT
 ---
 

package/skills/yotta-verify-mcp/scripts/yotta_verify.py

@@ -52,7 +52,7 @@ sys.path.insert(0, str(_HERE))
 import verify_rules  # noqa: E402
 import threat_engine  # noqa: E402
 
-VERSION = "0.4.0"
+VERSION = "0.4.2"
 TOOL_NAME = "yotta-verify"
 CN_NAME = "元信"
 
@@ -436,6 +436,8 @@ def downgrade_detector_docs(findings, root):
     if not is_detector_skill(root):
         return
     for f in findings:
+        if f.detector == "Structure":
+            continue
         if f.severity in ("critical", "high", "medium"):
             if Path(f.file_path).suffix.lower() in _DOC_EXT:
                 f.severity = "info"
@@ -492,19 +494,71 @@ def exit_code_of(verdict):
 # ── 扫描主流程 ─────────────────────────────────────────────────────────────
 
 def _safe_extract(tf, dest):
-    """提取 tarball（Python 3.8 兼容；手工路径穿越防护）。"""
+    """提取 tarball（Python 3.8 兼容；拒绝路径穿越、链接与特殊文件）。"""
+    safe_members = []
+    root = Path(dest).resolve()
     for member in tf.getmembers():
-        name = member.name
-        if name.startswith(("/", "\\")) or ".." in Path(name).parts:
+        name = member.name.replace("\\", "/")
+        drive_path = len(name) >= 2 and name[1] == ":" and name[0].isalpha()
+        if (not name or name.startswith("/") or drive_path
+                or any(part == ".." for part in name.split("/"))):
             raise ValueError("tarball 含危险路径: %s" % name)
-    tf.extractall(dest)
+        if member.issym() or member.islnk() or member.isdev() or member.isfifo():
+            raise ValueError("tarball 含链接或特殊文件成员: %s" % member.name)
+        parts = [part for part in name.split("/") if part not in ("", ".")]
+        target = root.joinpath(*parts).resolve()
+        try:
+            target.relative_to(root)
+        except ValueError:
+            raise ValueError("tarball 成员越出临时目录: %s" % member.name)
+        member.mode = member.mode & 0o777
+        safe_members.append(member)
+    if sys.version_info >= (3, 12):
+        tf.extractall(dest, members=safe_members, filter="data")
+    else:
+        tf.extractall(dest, members=safe_members)
 
 
-def scan_core(target, name_hint=None):
+def _package_slug_from_root(root):
+    """从包根 package.json 读取 npm 包名并归一为技能 slug。"""
+    try:
+        data = json.loads((root / "package.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    name = data.get("name") if isinstance(data, dict) else None
+    if not isinstance(name, str):
+        return None
+    slug = name.strip().rsplit("/", 1)[-1]
+    if not slug or slug in (".", "..") or "/" in slug or "\\" in slug:
+        return None
+    return slug
+
+
+def resolve_name_hint(target, root, from_archive=False):
+    """解析 STR-004 的期望名称：安装目录用目录名，npm 包输入用包名。"""
+    if from_archive:
+        package_root = root / "package"
+        if package_root.is_dir():
+            root = package_root
+        slug = _package_slug_from_root(root)
+        if slug:
+            return slug
+        return Path(target).name
+    if root.name == "package":
+        slug = _package_slug_from_root(root)
+        if slug:
+            return slug
+        return root.name
+    return root.name
+
+
+def scan_core(target, name_hint=None, auto_name_hint=False):
     """扫描目录/tarball，返回 (findings, counts, verdict, scan_meta)。"""
     tmpdir = None
     root = Path(target)
+    from_archive = False
     if root.is_file() and str(root).lower().endswith((".tgz", ".tar.gz")):
+        from_archive = True
         tmpdir = tempfile.mkdtemp(prefix="yotta-verify-")
         with tarfile.open(str(root), "r:gz") as tf:
             _safe_extract(tf, tmpdir)
@@ -514,6 +568,8 @@ def scan_core(target, name_hint=None):
             import shutil
             shutil.rmtree(tmpdir, ignore_errors=True)
         raise SystemExit("目标不存在或不是目录: %s" % target)
+    if auto_name_hint and name_hint is None:
+        name_hint = resolve_name_hint(target, root, from_archive=from_archive)
     files = walk_files(root)
     findings = scan_patterns(files)
     check_skill_integrity(root, findings, name_hint)
@@ -748,12 +804,8 @@ def shields_url(verdict):
 
 # ── CLI ─────────────────────────────────────────────────────────────────────
 
-def _name_hint(target):
-    return Path(target).name
-
-
 def cmd_scan(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     code = exit_code_of(verdict)
     # gate 模式
     if args.max_severity:
@@ -801,7 +853,7 @@ def cmd_badge(args):
     }
     # 若给目录：先扫描拿 verdict；否则默认 SAFE
     if args.path and Path(args.path).exists():
-        findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+        findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     else:
         verdict = VERDICT_SAFE
         counts = {s: 0 for s in _SEVERITY_ORDER}
@@ -815,7 +867,7 @@ def cmd_badge(args):
 
 
 def cmd_report(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     if args.json:
         print(render_json(findings, counts, verdict, meta))
     else:
@@ -830,7 +882,7 @@ def cmd_report(args):
 
 
 def cmd_gate(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     code = exit_code_of(verdict)
     limit = _SEVERITY_VALUE.get((args.max_severity or "medium").lower(), 1)
     worst = _SEVERITY_VALUE.get(verdict_worst(findings), 0)

package/skills/yotta-verify-mcp/scripts/yotta_verify_mcp.py

@@ -27,7 +27,7 @@ sys.path.insert(0, str(_HERE))
 
 import yotta_verify as yv  # noqa: E402
 
-VERSION = "0.4.1"
+VERSION = "0.4.2"
 TOOL_NAME = "yotta-verify-mcp"
 CN_NAME = "元信"
 MCP_PROTOCOL_MODERN = "2026-07-28"
@@ -45,10 +45,6 @@ def _tool_error(message, extra=None):
             "isError": True}
 
 
-def _name_hint(path):
-    return Path(path).name
-
-
 def _resolve_target(target, tmp_dirs):
     """把 target 解析为本地路径/压缩包路径；npm 包名则 npm pack 到临时目录。"""
     p = Path(target)
@@ -77,7 +73,7 @@ def _scan(target):
     tmp_dirs = []
     try:
         path = _resolve_target(target, tmp_dirs)
-        findings, counts, verdict, meta = yv.scan_core(path, name_hint=_name_hint(path))
+        findings, counts, verdict, meta = yv.scan_core(path, auto_name_hint=True)
         return findings, counts, verdict, meta, None
     except SystemExit as e:
         return None, None, None, None, str(e)