@yottameta/yotta-verify-mcp-plugin 0.4.1 → 0.4.3

package/.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.1",
+      "version": "0.4.3",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.1",
+      "version": "0.4.3",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-verify-mcp-plugin",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "YuanXinMCP (元信MCP) — pre-install security scanning for Agent skills, packaged as a YottaMeta Agent Plugin.",
   "license": "MIT",
   "keywords": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "yotta-verify-mcp",
-  "version": "0.4.1",
+  "version": "0.4.3",
   "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
   "author": {
     "name": "YottaMeta",

package/skills/yotta-verify-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-verify-mcp
 description: 元信MCP（yotta-verify-mcp）—— 把元信（yotta-verify）装前安全扫描暴露为 stdio MCP server，提供 scan_skill（目录/包 → verdict+发现）、generate_badge（audited 徽章）、gate_check（CI 闸门）、get_report（JSON/Markdown 双视角综合报告）四个 MCP 工具。触发：给 MCP 客户端配置元信MCP、把装前信任扫描接入智能体/工作流、调用上列 MCP 工具做扫描；或用户说 MCP元信/元信MCP/trust-mcp/scan-mcp 等。边界：本地离线静态扫描，不上传被测内容、不执行被测代码、不联网；结论需人工确认。MCP 配置与全局/永久记忆写入均为可选，必须先获得用户明确同意；未获同意前不写任何文件，可直接降级 CLI。
-version: 0.4.1
+version: 0.4.3
 license: MIT
 ---
 

package/skills/yotta-verify-mcp/scripts/yotta_verify.py

@@ -30,6 +30,7 @@ exit code 语义（与元安/元审一致）：
 """
 import argparse
 import base64
+import hashlib
 import json
 import re
 import sys
@@ -52,7 +53,7 @@ sys.path.insert(0, str(_HERE))
 import verify_rules  # noqa: E402
 import threat_engine  # noqa: E402
 
-VERSION = "0.4.0"
+VERSION = "0.4.3"
 TOOL_NAME = "yotta-verify"
 CN_NAME = "元信"
 
@@ -74,8 +75,49 @@ DOTFILE_NAMES = {
 MAX_FILE_SIZE = 1_000_000
 MAX_LINE_LEN = verify_rules.MAX_LINE_LEN
 MAX_FILES = 2000
-# 签名数据文件：规则表是扫描器自身的签名数据库，不是被测技能行为，扫描时跳过
+# 签名数据文件：规则表是扫描器自身与家族检测技能的签名数据库，不是被测技能行为。
+# v0.3.2 收紧（旧行为 = 按文件名全局豁免，`scripts/<同名>.py` 可被随意伪造以逃避扫描）：
+#   ① 相对路径必须恰为 scripts/<规则表名>.py；
+#   ② 文件 SHA-256（CRLF 归一化）必须命中「已发布规则表摘要表」。
+# 任一条不满足 → 正常扫描（fail-closed），杜绝「改名即豁免」与「放标记文件即降级」。
 SIGNATURE_DATA_FILES = {"verify_rules.py", "audit_rules.py", "vetter_rules.py", "hardening_rules.py"}
+SIGNATURE_DATA_DIGESTS = {
+    "verify_rules.py": {"8d8c128911b05b24413cc3aec8a2d1c36c1ccf66f656330f723cd68718bda8bd"},
+    "vetter_rules.py": {"fc5bad6a7705f9fde60f4fdaf540a3aaa6490448d1fe22ed264e3f812c8ba092"},
+    "audit_rules.py": {"475ba1daee436589997260291917126218ae7cae572d16eb59459ca5a2192d23"},
+    "hardening_rules.py": {"6b9cbdaa106ae7f5827e60f83c016c237d4cd28785426930abc24cde00bcf5c7"},
+    "guardian_rules.py": {"a9fc0da3e0344d485b20c55378b58bc81d78ecbb28a7f2b3bd44bcbed06aebe3"},
+}
+
+
+def _sha256_normalized(path):
+    """CRLF 归一化后的 SHA-256（跨 Windows / Linux 检出结果一致）。"""
+    try:
+        data = path.read_bytes().replace(b"\r\n", b"\n")
+    except OSError:
+        return None
+    return hashlib.sha256(data).hexdigest()
+
+
+def is_signature_data(rel, path):
+    """是否为「已发布」的家族规则表：路径 + 内容摘要双绑定。"""
+    known = SIGNATURE_DATA_DIGESTS.get(path.name)
+    if not known:
+        return False
+    parts = str(rel).replace("\\", "/").split("/")
+    if len(parts) != 2 or parts[0] != "scripts":
+        return False
+    digest = _sha256_normalized(path)
+    return bool(digest) and digest in known
+
+
+def has_published_signature_data(root):
+    """目标包是否持有已发布签名数据（用于测试夹具跳过与文档降级判定）。"""
+    for name in SIGNATURE_DATA_DIGESTS:
+        p = Path(root) / "scripts" / name
+        if p.is_file() and is_signature_data("scripts/" + name, p):
+            return True
+    return False
 
 # ── 严重级 / verdict ───────────────────────────────────────────────────────
 _SEVERITY_VALUE = verify_rules.SEVERITY_VALUE
@@ -143,19 +185,26 @@ def is_text_file(name):
     return Path(p).suffix in TEXT_EXTENSIONS
 
 
-def walk_files(root, base=""):
-    """递归收集可扫描文本文件（跳过 SKIP_DIRS / 签名数据 / 超限）。"""
+def walk_files(root, base="", trusted_tests=None, scan_root=None):
+    """递归收集可扫描文本文件（跳过 SKIP_DIRS / 已发布签名数据 / 超限）。
+
+    trusted_tests 只在「目标包持有已发布签名数据」时为真——此时 `test_*.py`
+    视为自家测试夹具跳过；第三方包的同名文件照常扫描（v0.3.2 起）。
+    """
     out = []
+    if scan_root is None:
+        scan_root = root
+        trusted_tests = has_published_signature_data(scan_root)
     try:
         entries = sorted(root.iterdir())
     except OSError:
         return out
     for entry in entries:
-        if entry.name in SKIP_DIRS or entry.name in SIGNATURE_DATA_FILES:
+        if entry.name in SKIP_DIRS:
             continue
         rel = entry.name if not base else base + "/" + entry.name
         if entry.is_dir():
-            out.extend(walk_files(entry, rel))
+            out.extend(walk_files(entry, rel, trusted_tests, scan_root))
         elif entry.is_file():
             try:
                 size = entry.stat().st_size
@@ -163,8 +212,11 @@ def walk_files(root, base=""):
                 continue
             if size > MAX_FILE_SIZE:
                 continue
-            # 测试文件为签名/测试数据（含构造的恶意样例），非被测技能行为，跳过
-            if entry.name.startswith("test_") and entry.name.endswith(".py"):
+            # 已发布规则表（路径 + 摘要绑定）不是被测技能行为，跳过
+            if is_signature_data(rel, entry):
+                continue
+            # 自家包的测试夹具（含构造样例）跳过；第三方包不豁免
+            if trusted_tests and entry.name.startswith("test_") and entry.name.endswith(".py"):
                 continue
             if is_text_file(entry.name):
                 out.append((entry, rel))
@@ -420,11 +472,12 @@ _DOC_EXT = {".md", ".txt", ".markdown", ".rst"}
 
 
 def is_detector_skill(root):
-    """目标目录是否含检测器签名文件（audit_rules/verify_rules/vetter_rules/hardening_rules）。"""
-    for name in _DETECTOR_SIG_FILES:
-        if (root / name).is_file() or (root / "scripts" / name).is_file():
-            return True
-    return False
+    """目标是否为家族检测技能（v0.3.2：须持「已发布」规则表，路径 + 摘要绑定）。
+
+    旧行为 = 只看目录里有没有同名文件（放一个标记文件即可把整包文档命中降级为
+    info）。现改为内容摘要绑定：未验证的同名文件不构成检测器签名。
+    """
+    return has_published_signature_data(root)
 
 
 def downgrade_detector_docs(findings, root):
@@ -436,6 +489,8 @@ def downgrade_detector_docs(findings, root):
     if not is_detector_skill(root):
         return
     for f in findings:
+        if f.detector == "Structure":
+            continue
         if f.severity in ("critical", "high", "medium"):
             if Path(f.file_path).suffix.lower() in _DOC_EXT:
                 f.severity = "info"
@@ -492,19 +547,71 @@ def exit_code_of(verdict):
 # ── 扫描主流程 ─────────────────────────────────────────────────────────────
 
 def _safe_extract(tf, dest):
-    """提取 tarball（Python 3.8 兼容；手工路径穿越防护）。"""
+    """提取 tarball（Python 3.8 兼容；拒绝路径穿越、链接与特殊文件）。"""
+    safe_members = []
+    root = Path(dest).resolve()
     for member in tf.getmembers():
-        name = member.name
-        if name.startswith(("/", "\\")) or ".." in Path(name).parts:
+        name = member.name.replace("\\", "/")
+        drive_path = len(name) >= 2 and name[1] == ":" and name[0].isalpha()
+        if (not name or name.startswith("/") or drive_path
+                or any(part == ".." for part in name.split("/"))):
             raise ValueError("tarball 含危险路径: %s" % name)
-    tf.extractall(dest)
+        if member.issym() or member.islnk() or member.isdev() or member.isfifo():
+            raise ValueError("tarball 含链接或特殊文件成员: %s" % member.name)
+        parts = [part for part in name.split("/") if part not in ("", ".")]
+        target = root.joinpath(*parts).resolve()
+        try:
+            target.relative_to(root)
+        except ValueError:
+            raise ValueError("tarball 成员越出临时目录: %s" % member.name)
+        member.mode = member.mode & 0o777
+        safe_members.append(member)
+    if sys.version_info >= (3, 12):
+        tf.extractall(dest, members=safe_members, filter="data")
+    else:
+        tf.extractall(dest, members=safe_members)
 
 
-def scan_core(target, name_hint=None):
+def _package_slug_from_root(root):
+    """从包根 package.json 读取 npm 包名并归一为技能 slug。"""
+    try:
+        data = json.loads((root / "package.json").read_text(encoding="utf-8"))
+    except (OSError, ValueError):
+        return None
+    name = data.get("name") if isinstance(data, dict) else None
+    if not isinstance(name, str):
+        return None
+    slug = name.strip().rsplit("/", 1)[-1]
+    if not slug or slug in (".", "..") or "/" in slug or "\\" in slug:
+        return None
+    return slug
+
+
+def resolve_name_hint(target, root, from_archive=False):
+    """解析 STR-004 的期望名称：安装目录用目录名，npm 包输入用包名。"""
+    if from_archive:
+        package_root = root / "package"
+        if package_root.is_dir():
+            root = package_root
+        slug = _package_slug_from_root(root)
+        if slug:
+            return slug
+        return Path(target).name
+    if root.name == "package":
+        slug = _package_slug_from_root(root)
+        if slug:
+            return slug
+        return root.name
+    return root.name
+
+
+def scan_core(target, name_hint=None, auto_name_hint=False):
     """扫描目录/tarball，返回 (findings, counts, verdict, scan_meta)。"""
     tmpdir = None
     root = Path(target)
+    from_archive = False
     if root.is_file() and str(root).lower().endswith((".tgz", ".tar.gz")):
+        from_archive = True
         tmpdir = tempfile.mkdtemp(prefix="yotta-verify-")
         with tarfile.open(str(root), "r:gz") as tf:
             _safe_extract(tf, tmpdir)
@@ -514,6 +621,8 @@ def scan_core(target, name_hint=None):
             import shutil
             shutil.rmtree(tmpdir, ignore_errors=True)
         raise SystemExit("目标不存在或不是目录: %s" % target)
+    if auto_name_hint and name_hint is None:
+        name_hint = resolve_name_hint(target, root, from_archive=from_archive)
     files = walk_files(root)
     findings = scan_patterns(files)
     check_skill_integrity(root, findings, name_hint)
@@ -748,12 +857,8 @@ def shields_url(verdict):
 
 # ── CLI ─────────────────────────────────────────────────────────────────────
 
-def _name_hint(target):
-    return Path(target).name
-
-
 def cmd_scan(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     code = exit_code_of(verdict)
     # gate 模式
     if args.max_severity:
@@ -801,7 +906,7 @@ def cmd_badge(args):
     }
     # 若给目录：先扫描拿 verdict；否则默认 SAFE
     if args.path and Path(args.path).exists():
-        findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+        findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     else:
         verdict = VERDICT_SAFE
         counts = {s: 0 for s in _SEVERITY_ORDER}
@@ -815,7 +920,7 @@ def cmd_badge(args):
 
 
 def cmd_report(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     if args.json:
         print(render_json(findings, counts, verdict, meta))
     else:
@@ -830,7 +935,7 @@ def cmd_report(args):
 
 
 def cmd_gate(args):
-    findings, counts, verdict, meta = scan_core(args.path, name_hint=_name_hint(args.path))
+    findings, counts, verdict, meta = scan_core(args.path, auto_name_hint=True)
     code = exit_code_of(verdict)
     limit = _SEVERITY_VALUE.get((args.max_severity or "medium").lower(), 1)
     worst = _SEVERITY_VALUE.get(verdict_worst(findings), 0)

package/skills/yotta-verify-mcp/scripts/yotta_verify_mcp.py

@@ -27,7 +27,7 @@ sys.path.insert(0, str(_HERE))
 
 import yotta_verify as yv  # noqa: E402
 
-VERSION = "0.4.1"
+VERSION = "0.4.3"
 TOOL_NAME = "yotta-verify-mcp"
 CN_NAME = "元信"
 MCP_PROTOCOL_MODERN = "2026-07-28"
@@ -45,10 +45,6 @@ def _tool_error(message, extra=None):
             "isError": True}
 
 
-def _name_hint(path):
-    return Path(path).name
-
-
 def _resolve_target(target, tmp_dirs):
     """把 target 解析为本地路径/压缩包路径；npm 包名则 npm pack 到临时目录。"""
     p = Path(target)
@@ -77,7 +73,7 @@ def _scan(target):
     tmp_dirs = []
     try:
         path = _resolve_target(target, tmp_dirs)
-        findings, counts, verdict, meta = yv.scan_core(path, name_hint=_name_hint(path))
+        findings, counts, verdict, meta = yv.scan_core(path, auto_name_hint=True)
         return findings, counts, verdict, meta, None
     except SystemExit as e:
         return None, None, None, None, str(e)