@yottameta/yotta-verify-mcp-plugin 0.4.2 → 0.4.4

package/.agents/plugins/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.2",
+      "version": "0.4.4",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/.claude-plugin/marketplace.json

@@ -12,7 +12,7 @@
         "authentication": "ON_INSTALL"
       },
       "category": "Security",
-      "version": "0.4.2",
+      "version": "0.4.4",
       "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
       "interface": {
         "displayName": "元信MCP yotta-verify-mcp",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-verify-mcp-plugin",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "YuanXinMCP (元信MCP) — pre-install security scanning for Agent skills, packaged as a YottaMeta Agent Plugin.",
   "license": "MIT",
   "keywords": [

package/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
   "name": "yotta-verify-mcp",
-  "version": "0.4.2",
+  "version": "0.4.4",
   "description": "YuanXinMCP (元信MCP) - the pre-install security scanner for Agent skills, exposed as a stdio MCP server: scan_skill (dir/package -> verdict + findings), generate_badge (audited badge), gate_check (CI gate), get_report (JSON/Markdown). Local offline static scan; no upload of scanned content, no execution of scanned code; human confirmation required.",
   "author": {
     "name": "YottaMeta",

package/skills/yotta-verify-mcp/SKILL.md

@@ -1,7 +1,7 @@
 ---
 name: yotta-verify-mcp
 description: 元信MCP（yotta-verify-mcp）—— 把元信（yotta-verify）装前安全扫描暴露为 stdio MCP server，提供 scan_skill（目录/包 → verdict+发现）、generate_badge（audited 徽章）、gate_check（CI 闸门）、get_report（JSON/Markdown 双视角综合报告）四个 MCP 工具。触发：给 MCP 客户端配置元信MCP、把装前信任扫描接入智能体/工作流、调用上列 MCP 工具做扫描；或用户说 MCP元信/元信MCP/trust-mcp/scan-mcp 等。边界：本地离线静态扫描，不上传被测内容、不执行被测代码、不联网；结论需人工确认。MCP 配置与全局/永久记忆写入均为可选，必须先获得用户明确同意；未获同意前不写任何文件，可直接降级 CLI。
-version: 0.4.2
+version: 0.4.4
 license: MIT
 ---
 

package/skills/yotta-verify-mcp/scripts/yotta_verify.py

@@ -30,6 +30,7 @@ exit code 语义（与元安/元审一致）：
 """
 import argparse
 import base64
+import hashlib
 import json
 import re
 import sys
@@ -52,7 +53,7 @@ sys.path.insert(0, str(_HERE))
 import verify_rules  # noqa: E402
 import threat_engine  # noqa: E402
 
-VERSION = "0.4.2"
+VERSION = "0.4.4"
 TOOL_NAME = "yotta-verify"
 CN_NAME = "元信"
 
@@ -74,8 +75,63 @@ DOTFILE_NAMES = {
 MAX_FILE_SIZE = 1_000_000
 MAX_LINE_LEN = verify_rules.MAX_LINE_LEN
 MAX_FILES = 2000
-# 签名数据文件：规则表是扫描器自身的签名数据库，不是被测技能行为，扫描时跳过
+# v0.4.4：不可静态分析的可执行 / 二进制载荷不再静默跳过（fail-closed）。
+# 旧行为只对 TEXT_EXTENSIONS 做内容分析，`.exe` / `.dll` / `.jar` / 无扩展名二进制
+# 会被直接忽略——攻击方可以把载荷放进这些文件逃避扫描。现在按扩展名 + 魔数识别，
+# 命中即出 STR-009（medium），扫描结论至少为「需复核」。
+OPAQUE_EXTENSIONS = {
+    ".exe", ".dll", ".sys", ".com", ".msi", ".scr", ".cab", ".cpl",
+    ".so", ".dylib", ".bin", ".o", ".a",
+    ".jar", ".class", ".apk", ".dex", ".wasm", ".node",
+}
+OPAQUE_MAGIC = (b"\x7fELF", b"MZ", b"\xca\xfe\xba\xbe", b"\xcf\xfa\xed\xfe")
+# tarball 解包上限（防资源耗尽）
+MAX_TARBALL_MEMBERS = 2000
+MAX_TARBALL_MEMBER_BYTES = 50 * 1024 * 1024
+MAX_TARBALL_TOTAL_BYTES = 200 * 1024 * 1024
+# 签名数据文件：规则表是扫描器自身与家族检测技能的签名数据库，不是被测技能行为。
+# v0.3.2 收紧（旧行为 = 按文件名全局豁免，`scripts/<同名>.py` 可被随意伪造以逃避扫描）：
+#   ① 相对路径必须恰为 scripts/<规则表名>.py；
+#   ② 文件 SHA-256（CRLF 归一化）必须命中「已发布规则表摘要表」。
+# 任一条不满足 → 正常扫描（fail-closed），杜绝「改名即豁免」与「放标记文件即降级」。
 SIGNATURE_DATA_FILES = {"verify_rules.py", "audit_rules.py", "vetter_rules.py", "hardening_rules.py"}
+SIGNATURE_DATA_DIGESTS = {
+    "verify_rules.py": {"8d8c128911b05b24413cc3aec8a2d1c36c1ccf66f656330f723cd68718bda8bd"},
+    "vetter_rules.py": {"fc5bad6a7705f9fde60f4fdaf540a3aaa6490448d1fe22ed264e3f812c8ba092"},
+    "audit_rules.py": {"475ba1daee436589997260291917126218ae7cae572d16eb59459ca5a2192d23"},
+    "hardening_rules.py": {"6b9cbdaa106ae7f5827e60f83c016c237d4cd28785426930abc24cde00bcf5c7"},
+    "guardian_rules.py": {"a9fc0da3e0344d485b20c55378b58bc81d78ecbb28a7f2b3bd44bcbed06aebe3"},
+}
+
+
+def _sha256_normalized(path):
+    """CRLF 归一化后的 SHA-256（跨 Windows / Linux 检出结果一致）。"""
+    try:
+        data = path.read_bytes().replace(b"\r\n", b"\n")
+    except OSError:
+        return None
+    return hashlib.sha256(data).hexdigest()
+
+
+def is_signature_data(rel, path):
+    """是否为「已发布」的家族规则表：路径 + 内容摘要双绑定。"""
+    known = SIGNATURE_DATA_DIGESTS.get(path.name)
+    if not known:
+        return False
+    parts = str(rel).replace("\\", "/").split("/")
+    if len(parts) != 2 or parts[0] != "scripts":
+        return False
+    digest = _sha256_normalized(path)
+    return bool(digest) and digest in known
+
+
+def has_published_signature_data(root):
+    """目标包是否持有已发布签名数据（用于测试夹具跳过与文档降级判定）。"""
+    for name in SIGNATURE_DATA_DIGESTS:
+        p = Path(root) / "scripts" / name
+        if p.is_file() and is_signature_data("scripts/" + name, p):
+            return True
+    return False
 
 # ── 严重级 / verdict ───────────────────────────────────────────────────────
 _SEVERITY_VALUE = verify_rules.SEVERITY_VALUE
@@ -143,19 +199,26 @@ def is_text_file(name):
     return Path(p).suffix in TEXT_EXTENSIONS
 
 
-def walk_files(root, base=""):
-    """递归收集可扫描文本文件（跳过 SKIP_DIRS / 签名数据 / 超限）。"""
+def walk_files(root, base="", trusted_tests=None, scan_root=None):
+    """递归收集可扫描文本文件（跳过 SKIP_DIRS / 已发布签名数据 / 超限）。
+
+    trusted_tests 只在「目标包持有已发布签名数据」时为真——此时 `test_*.py`
+    视为自家测试夹具跳过；第三方包的同名文件照常扫描（v0.3.2 起）。
+    """
     out = []
+    if scan_root is None:
+        scan_root = root
+        trusted_tests = has_published_signature_data(scan_root)
     try:
         entries = sorted(root.iterdir())
     except OSError:
         return out
     for entry in entries:
-        if entry.name in SKIP_DIRS or entry.name in SIGNATURE_DATA_FILES:
+        if entry.name in SKIP_DIRS:
             continue
         rel = entry.name if not base else base + "/" + entry.name
         if entry.is_dir():
-            out.extend(walk_files(entry, rel))
+            out.extend(walk_files(entry, rel, trusted_tests, scan_root))
         elif entry.is_file():
             try:
                 size = entry.stat().st_size
@@ -163,8 +226,11 @@ def walk_files(root, base=""):
                 continue
             if size > MAX_FILE_SIZE:
                 continue
-            # 测试文件为签名/测试数据（含构造的恶意样例），非被测技能行为，跳过
-            if entry.name.startswith("test_") and entry.name.endswith(".py"):
+            # 已发布规则表（路径 + 摘要绑定）不是被测技能行为，跳过
+            if is_signature_data(rel, entry):
+                continue
+            # 自家包的测试夹具（含构造样例）跳过；第三方包不豁免
+            if trusted_tests and entry.name.startswith("test_") and entry.name.endswith(".py"):
                 continue
             if is_text_file(entry.name):
                 out.append((entry, rel))
@@ -173,6 +239,57 @@ def walk_files(root, base=""):
     return out
 
 
+def _read_magic(path, size=4):
+    try:
+        with open(str(path), "rb") as fh:
+            return fh.read(size)
+    except OSError:
+        return b""
+
+
+def find_opaque_files(root):
+    """列出无法静态分析、但带可执行 / 二进制特征的文件（v0.4.4，fail-closed）。"""
+    out = []
+    if root.is_file():
+        candidates = [(root, root.name)]
+    else:
+        candidates = []
+        stack = [root]
+        while stack:
+            cur = stack.pop()
+            try:
+                entries = sorted(cur.iterdir())
+            except OSError:
+                continue
+            for entry in entries:
+                if entry.name in SKIP_DIRS:
+                    continue
+                if entry.is_dir():
+                    stack.append(entry)
+                elif entry.is_file():
+                    rel = str(entry.relative_to(root)).replace("\\", "/")
+                    candidates.append((entry, rel))
+    for path, rel in candidates:
+        name = path.name.lower()
+        if name in DOTFILE_NAMES or Path(name).suffix in TEXT_EXTENSIONS:
+            continue
+        suffix = Path(name).suffix
+        opaque = suffix in OPAQUE_EXTENSIONS
+        if not opaque:
+            magic = _read_magic(path)
+            opaque = any(magic.startswith(sig) for sig in OPAQUE_MAGIC)
+        if not opaque:
+            continue
+        try:
+            size = path.stat().st_size
+        except OSError:
+            size = 0
+        out.append((rel, size))
+        if len(out) >= 50:
+            break
+    return out
+
+
 def read_lines(path):
     """读取文本文件行列表（容错编码；超长行截断）。"""
     try:
@@ -420,11 +537,12 @@ _DOC_EXT = {".md", ".txt", ".markdown", ".rst"}
 
 
 def is_detector_skill(root):
-    """目标目录是否含检测器签名文件（audit_rules/verify_rules/vetter_rules/hardening_rules）。"""
-    for name in _DETECTOR_SIG_FILES:
-        if (root / name).is_file() or (root / "scripts" / name).is_file():
-            return True
-    return False
+    """目标是否为家族检测技能（v0.3.2：须持「已发布」规则表，路径 + 摘要绑定）。
+
+    旧行为 = 只看目录里有没有同名文件（放一个标记文件即可把整包文档命中降级为
+    info）。现改为内容摘要绑定：未验证的同名文件不构成检测器签名。
+    """
+    return has_published_signature_data(root)
 
 
 def downgrade_detector_docs(findings, root):
@@ -494,10 +612,15 @@ def exit_code_of(verdict):
 # ── 扫描主流程 ─────────────────────────────────────────────────────────────
 
 def _safe_extract(tf, dest):
-    """提取 tarball（Python 3.8 兼容；拒绝路径穿越、链接与特殊文件）。"""
+    """提取 tarball（Python 3.8 兼容；拒绝路径穿越、链接与特殊文件；v0.4.4 加解包上限）。"""
     safe_members = []
     root = Path(dest).resolve()
-    for member in tf.getmembers():
+    members = tf.getmembers()
+    if len(members) > MAX_TARBALL_MEMBERS:
+        raise ValueError("tarball 成员数超过上限: %d > %d"
+                         % (len(members), MAX_TARBALL_MEMBERS))
+    total_bytes = 0
+    for member in members:
         name = member.name.replace("\\", "/")
         drive_path = len(name) >= 2 and name[1] == ":" and name[0].isalpha()
         if (not name or name.startswith("/") or drive_path
@@ -505,6 +628,12 @@ def _safe_extract(tf, dest):
             raise ValueError("tarball 含危险路径: %s" % name)
         if member.issym() or member.islnk() or member.isdev() or member.isfifo():
             raise ValueError("tarball 含链接或特殊文件成员: %s" % member.name)
+        size = int(member.size or 0)
+        if size > MAX_TARBALL_MEMBER_BYTES:
+            raise ValueError("tarball 单成员过大: %s（%d 字节）" % (member.name, size))
+        total_bytes += size
+        if total_bytes > MAX_TARBALL_TOTAL_BYTES:
+            raise ValueError("tarball 解包总量超过上限: %d 字节" % total_bytes)
         parts = [part for part in name.split("/") if part not in ("", ".")]
         target = root.joinpath(*parts).resolve()
         try:
@@ -572,6 +701,13 @@ def scan_core(target, name_hint=None, auto_name_hint=False):
         name_hint = resolve_name_hint(target, root, from_archive=from_archive)
     files = walk_files(root)
     findings = scan_patterns(files)
+    # v0.4.4：不可静态分析的可执行 / 二进制载荷按 fail-closed 处理（不再静默跳过）
+    for rel, size in find_opaque_files(root):
+        findings.append(Finding(
+            "Structure", "medium", "不可扫描内容",
+            rel, 0,
+            "包内含无法静态分析的可执行 / 二进制文件（%d 字节），需人工确认来源与用途"
+            % size, 70, "STR-009"))
     check_skill_integrity(root, findings, name_hint)
     permission_summary(files, findings)
     # 检测技能文档降级（2026-08-30）：目标含检测器签名文件（audit_rules 等）→

package/skills/yotta-verify-mcp/scripts/yotta_verify_mcp.py

@@ -27,7 +27,7 @@ sys.path.insert(0, str(_HERE))
 
 import yotta_verify as yv  # noqa: E402
 
-VERSION = "0.4.2"
+VERSION = "0.4.4"
 TOOL_NAME = "yotta-verify-mcp"
 CN_NAME = "元信"
 MCP_PROTOCOL_MODERN = "2026-07-28"