@yottameta/yotta-vetter 0.1.4 → 0.2.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # 更新日志
 
+## v0.2.2 (2026-08-30)
+
+安全家族检测能力增强 + 措辞规范（与元信 / 元安 v0.2.2 对齐）：
+
+- **报告升级（双视角）**：新增安全健康度评分（0-100） + 威胁捕获模型视图（8 检测点逐类 verdict） + 行为项（13 项），文本 / Markdown / JSON 三格式输出。
+- **规则同步**：vetter_rules 同步元安权威源至 61 条（新增 路径穿越 / MCP 工具面命令执行 / MCP 工具面任意文件读写 检测器）。
+- **措辞规范**：正文不再写版本号；统一对外表述（含代码注释与报告输出）。
+- 测试：12 / 12 全绿（Python 3.8 / 3.13）。
+
+## v0.1.5 (2026-08-29)
+
+- 安装方式统一为四方式（对齐发布规范 §3.3.1）：方式一 `npx -y @yottameta/yotta-vetter --agent <name>` / `--dir <dir>`（推荐，走 npm 源）；方式二 `git clone https://github.com/YottaMeta/yotta-vetter.git`；方式三 GitHub Download ZIP；方式四 `bash install.sh --agent/--dir/--list`。移除 `npx skills` 与 `-g` 推荐；中英双 README 安装节同步。
+- 版本对齐：package.json / SKILL.md / CHANGELOG / 引擎 VERSION / 测试断言 / README 锚点 = 0.1.5。
+- 维护修复：签名数据文件跳过列表加入 hardening_rules.py。
+- 无功能变更（仅文档与版本同步）。
+
 ## v0.1.4 (2026-08-29)
 
 维护性修复（签名数据豁免）：
@@ -25,7 +41,7 @@ README 按标准补全：新增「这是什么 / 核心价值 / 核心优势 /
 
 ## v0.1.0 (2026-08-26)
 
-YottaMeta 自有实现首版（重写自第三方技术包 skill-vetter v2.0.0，已完全重写，无上游代码）：
+YottaMeta 自有实现首版（零依赖自研 + 中文教学）：
 
 - check：四阶段初审（来源/代码/权限/风险）+ 危险模式规则扫描 + SKILL VETTING REPORT 报告。
 - 危险模式规则与 yotta-security-audit（元安）共用（vetter_rules.py 为 audit_rules.py 的同步副本）。
@@ -34,4 +50,4 @@ YottaMeta 自有实现首版（重写自第三方技术包 skill-vetter v2.0.0
 - 输出：文本 / --json / --report report.md（SKILL VETTING REPORT 模板，含结论/决策记录/时间戳/审查者）。
 - 零依赖（Python 3.8+ 标准库），Windows + Linux 通用，UTF-8 加固（GBK 控制台不崩）。
 - exit code 语义与元安一致：0=干净/仅 low，1=medium，2=high，3=critical，4=错误。
-- 版权：YottaMeta 纯自有 MIT + NOTICE 品牌声明；README 一行上游致谢。
+- 版权：YottaMeta 纯自有 MIT + NOTICE 品牌声明。

package/NOTICE

@@ -8,4 +8,4 @@
 2. 不得暗示派生作品由 YottaMeta 官方维护、认可或与之存在关联；
 3. 建议在派生作品中明确声明「与 YottaMeta 官方无关联」。
 
-上游来源致谢：本技能为 YottaMeta 全新实现，审查协议参考开源社区的 skill-vetter 类技能思路，无上游代码。
+来源声明：本技能由 YottaMeta 全新实现（零依赖自研 + 中文教学）。

package/README.md

@@ -41,7 +41,7 @@
 | **Semi-automated source** | source checks stars / last-updated / license with a local cache; degrades gracefully offline |
 | **Deep-scan handoff** | high-and-above automatically guides you into yotta-security-audit |
 | **Zero dependency** | Python 3.8+ standard library; no daemon / database; Windows + Linux |
-| **Ecosystem distribution** | GitHub + npm synced; install via npx / install.sh / manual copy |
+| **Ecosystem distribution** | GitHub + npm synced; four install methods (npx / git clone / Download ZIP / install.sh) |
 
 ## Commands / four-phase review protocol
 
@@ -87,53 +87,42 @@ python3 scripts/yotta_vetter.py source github:YottaMeta/yotta-memory
 
 ## Install
 
-Pick any one of the three methods; skill files are fetched from **npm** (GitHub is slower without a proxy; npm can use a domestic mirror).
+Pick any of the four methods below; the order is the recommended priority. Skill files always come from **npm** (GitHub can be slow without a proxy; npm supports mirrors).
 
-### Method 1: npm (recommended, one-liner)
-```bash
-# domestic mirror (optional): npm config set registry https://registry.npmmirror.com
-npx -y @yottameta/yotta-vetter -g
-npx -y @yottameta/yotta-vetter --dir <your-skills-dir>   # any agent: install to a specific directory
+### Method 1: npm one-liner (recommended)
+
+```text
+# Optional China mirror: npm config set registry https://registry.npmmirror.com
+npx -y @yottameta/yotta-vetter --agent <agent-name>      # install to the agent's default user-level skills dir
+npx -y @yottameta/yotta-vetter --dir <your-skills-dir>   # point to the skills dir itself (e.g. ~/.codex/skills)
 ```
-> Not in the preset list? Use --dir to point at the agent's skills directory, or manual copy (method 3). --list shows each agent's default directory. You can also npm pack @yottameta/yotta-vetter and unpack it to install via method 2 / 3.
 
-### Method 2: install.sh one-shot
-```bash
-bash install.sh -g    # user level; bash install.sh --list shows all directories
-bash install.sh --agent codex   # specific agent (--list shows available ones)
-bash install.sh       # project level: auto-detect existing .claude/.cursor/.codex skills dirs
-bash install.sh --dir /path/to/skills
+- `--agent <name>` installs to that agent's default user-level directory; `--list` shows each agent's default directory.
+- `--dir <path>` installs to the given directory; for agents not in the preset list, point `--dir` at their skills directory.
+- If the mirror has not synced the new package (404): add `--registry=https://registry.npmjs.org/` (a proxy may be needed in China), or wait for the mirror cache.
+
+### Method 2: git clone (developers / git available)
+
+```text
+git clone https://github.com/YottaMeta/yotta-vetter.git <your-skills-dir>/yotta-vetter
 ```
-> Covers 17 agent families including Trae / Qwen / Comate / CodeBuddy / Kimi. Windows users: works with Git Bash; otherwise use method 3.
 
-### Method 3: manual copy
-Copy the whole `yotta-vetter` folder into the target agent's skills directory. Common locations (user level; Windows uses %USERPROFILE%, Linux/macOS uses ~):
+### Method 3: GitHub Download ZIP (manual / no git)
 
-| Agent | User-level directory | Project-level directory |
-|---|---|---|
-| Codex | %USERPROFILE%\.codex\skills\yotta-vetter\ | .codex\skills\ |
-| Claude Code | %USERPROFILE%\.claude\skills\yotta-vetter\ | .claude\skills\ |
-| Cursor | %USERPROFILE%\.cursor\skills\yotta-vetter\ | .cursor\skills\ |
-| Windsurf | %USERPROFILE%\.codeium\windsurf\skills\yotta-vetter\ | .windsurf\skills\ |
-| opencode | %USERPROFILE%\.config\opencode\skills\yotta-vetter\ | .opencode\skills\ |
-| Gemini | %USERPROFILE%\.gemini\skills\yotta-vetter\ | .gemini\skills\ |
-| Goose | %USERPROFILE%\.config\goose\skills\yotta-vetter\ | .goose\skills\ |
-| Amp | %USERPROFILE%\.config\agents\skills\yotta-vetter\ | .agents\skills\ |
-| Kiro | %USERPROFILE%\.kiro\skills\yotta-vetter\ | .kiro\skills\ |
-| WorkBuddy | %USERPROFILE%\.workbuddy\skills\yotta-vetter\ | .workbuddy\skills\ |
-| Trae Code CLI | %USERPROFILE%\.traecli\skills\yotta-vetter\ | .traecli\skills\ |
-| Trae IDE (CN) | %USERPROFILE%\.trae-cn\skills\yotta-vetter\ | .trae\skills\ |
-| Qwen Code | %USERPROFILE%\.qwen\skills\yotta-vetter\ | .qwen\skills\ |
-| Comate | %USERPROFILE%\.comate\skills\yotta-vetter\ | .comate\skills\ |
-| CodeBuddy | %USERPROFILE%\.codebuddy\skills\yotta-vetter\ | .codebuddy\skills\ |
-| Kimi | %USERPROFILE%\.kimi\skills\yotta-vetter\ | .kimi\skills\ |
-| Generic AGENTS.md | %USERPROFILE%\.agents\skills\yotta-vetter\ | .agents\skills\ |
-
-> If Codex's CODEX_HOME is set, it overrides the default; the same applies to opencode's XDG_CONFIG_HOME. .agents\skills is not a universal directory — only OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot etc. read it; **Claude Code and Codex do not read it by default**. When unsure, use --dir or let the agent install it.
+On the GitHub repository `YottaMeta/yotta-vetter`, click **Code → Download ZIP**, unzip it and put the `yotta-vetter` folder into the agent's skills directory.
+
+### Method 4: install.sh (multi-agent one-liner script)
+
+```text
+bash install.sh --agent <name>   # install to the agent's default user-level directory
+bash install.sh --dir <path>     # install to the given directory
+bash install.sh --list           # list agents -> default directories
+```
 
+> Method 1 uses the npm registry (npmmirror / npmjs) and does not depend on GitHub; Methods 2/3 use GitHub and may fail without a proxy in China.
 ## Upgrade / uninstall
 
-- **Upgrade**: reinstall the latest version to overwrite — npx -y @yottameta/yotta-vetter -g or rerun bash install.sh -g. Old files inside the skill folder are overwritten; other project files are untouched.
+- **Upgrade**: reinstall the latest version to overwrite — rerun the install command you used (e.g. `npx -y @yottameta/yotta-vetter --agent <name>` or `bash install.sh --agent <name>`). Old files in the skill directory are replaced; other project files are untouched.
 - **Uninstall**: delete the yotta-vetter folder under the target agent's skills directory (see the table above). The skill stops taking effect after removal.
 
 ## FAQ
@@ -167,4 +156,4 @@ See [CHANGELOG.md](./CHANGELOG.md).
 
 ## License
 
-[MIT](./LICENSE) © YottaMeta. "Yuanshen" / "yotta-vetter" and the YottaMeta family names (yotta-* prefix) are YottaMeta brand identifiers; derived works must not reuse them, see [NOTICE](./NOTICE). The review protocol references open-source skill-vetter style skills; the implementation is YottaMeta's own.
+[MIT](./LICENSE) © YottaMeta. "Yuanshen" / "yotta-vetter" and the YottaMeta family names (yotta-* prefix) are YottaMeta brand identifiers; derived works must not reuse them, see [NOTICE](./NOTICE). YottaMeta original implementation (zero-dependency, self-developed).

package/README.zh-CN.md

@@ -41,7 +41,7 @@
 | **来源半自动** | source 命令查 stars/更新时间/许可证，本地缓存、无网络自动降级 |
 | **联动深度扫描** | high 及以上自动引导跑 yotta-security-audit |
 | **零依赖** | Python 3.8+ 标准库，无 daemon / 无数据库；Windows + Linux 通用 |
-| **生态分发** | GitHub + npm 双源同步发布；npx / install.sh / 手动复制三种安装方式 |
+| **生态分发** | GitHub + npm 双源同步发布；npx / git clone / Download ZIP / install.sh 四种安装方式 |
 
 ## 功能体系 / 四阶段审查协议
 
@@ -87,53 +87,42 @@ python3 scripts/yotta_vetter.py source github:YottaMeta/yotta-memory
 
 ## 安装
 
-三种方式任选其一，技能文件统一从 **npm** 获取（GitHub 无代理时较慢，npm 可配国内镜像加速）。
+以下四种方式任选，顺序即推荐优先级；技能文件一律从 **npm** 获取（GitHub 无代理较慢，npm 支持镜像）。
 
-### 方式一：npm（推荐，一行安装）
-```bash
-# 国内加速（可选）：npm config set registry https://registry.npmmirror.com
-npx -y @yottameta/yotta-vetter -g
-npx -y @yottameta/yotta-vetter --dir <你的技能目录>   # 任意智能体：指定目录安装
+### 方式一：npm 一行装（推荐）
+
+```text
+# 可选国内加速：npm config set registry https://registry.npmmirror.com
+npx -y @yottameta/yotta-vetter --agent <智能体名称>      # 装到指定智能体默认用户级技能目录
+npx -y @yottameta/yotta-vetter --dir <智能体的技能目录>  # 指到技能目录本身（如 ~/.codex/skills）
 ```
-> 智能体不在预置列表里？用 `--dir` 指定它的 skills 目录，或手动复制（方式三）。`--list` 可查看各智能体对应的默认目录。想手动拿文件也可 `npm pack @yottameta/yotta-vetter` 解包后按方式二/三安装。
 
-### 方式二：install.sh 一键安装
-```bash
-bash install.sh -g    # 用户级；bash install.sh --list 查看全部目录
-bash install.sh --agent codex   # 指定智能体（--list 可查看可用项）
-bash install.sh       # 项目级：自动检测已存在的 .claude/.cursor/.codex 等 skills 目录
-bash install.sh --dir /path/to/skills
+- `--agent <name>` 自动装到该智能体默认用户级目录；`--list` 可查看各智能体默认目录。
+- `--dir <路径>` 装到指定的技能目录；未收录的智能体用 `--dir` 指到它的技能目录。
+- npmmirror 未同步新包（404）：加 `--registry=https://registry.npmjs.org/`（国内需代理），或稍等镜像缓存。
+
+### 方式二：git clone（开发者 / 有 git 环境）
+
+```text
+git clone https://github.com/YottaMeta/yotta-vetter.git <智能体的技能目录>/yotta-vetter
 ```
-> 覆盖 17 类智能体，含国内 Trae / Qwen / Comate / CodeBuddy / Kimi。Windows 用户：装有 Git Bash 即可用；否则用方式三手动复制。
 
-### 方式三：手动复制
-把整个 `yotta-vetter` 文件夹复制到目标智能体的 skills 目录。常见位置（用户级；Windows 用 `%USERPROFILE%`，Linux/macOS 用 `~`）：
+### 方式三：GitHub 下载压缩包（手动 / 无 git 环境）
 
-| 智能体 | 用户级目录 | 项目级目录 |
-|---|---|---|
-| Codex | `%USERPROFILE%\.codex\skills\yotta-vetter\` | `.codex\skills\` |
-| Claude Code | `%USERPROFILE%\.claude\skills\yotta-vetter\` | `.claude\skills\` |
-| Cursor | `%USERPROFILE%\.cursor\skills\yotta-vetter\` | `.cursor\skills\` |
-| Windsurf | `%USERPROFILE%\.codeium\windsurf\skills\yotta-vetter\` | `.windsurf\skills\` |
-| opencode | `%USERPROFILE%\.config\opencode\skills\yotta-vetter\` | `.opencode\skills\` |
-| Gemini | `%USERPROFILE%\.gemini\skills\yotta-vetter\` | `.gemini\skills\` |
-| Goose | `%USERPROFILE%\.config\goose\skills\yotta-vetter\` | `.goose\skills\` |
-| Amp | `%USERPROFILE%\.config\agents\skills\yotta-vetter\` | `.agents\skills\` |
-| Kiro | `%USERPROFILE%\.kiro\skills\yotta-vetter\` | `.kiro\skills\` |
-| WorkBuddy | `%USERPROFILE%\.workbuddy\skills\yotta-vetter\` | `.workbuddy\skills\` |
-| Trae Code CLI | `%USERPROFILE%\.traecli\skills\yotta-vetter\` | `.traecli\skills\` |
-| Trae IDE（国内） | `%USERPROFILE%\.trae-cn\skills\yotta-vetter\` | `.trae\skills\` |
-| Qwen Code | `%USERPROFILE%\.qwen\skills\yotta-vetter\` | `.qwen\skills\` |
-| Comate | `%USERPROFILE%\.comate\skills\yotta-vetter\` | `.comate\skills\` |
-| CodeBuddy | `%USERPROFILE%\.codebuddy\skills\yotta-vetter\` | `.codebuddy\skills\` |
-| Kimi | `%USERPROFILE%\.kimi\skills\yotta-vetter\` | `.kimi\skills\` |
-| 通用 AGENTS.md | `%USERPROFILE%\.agents\skills\yotta-vetter\` | `.agents\skills\` |
-
-> Codex 默认目录若设置了环境变量 `CODEX_HOME`，以该变量为准；opencode 若设置 `XDG_CONFIG_HOME` 同理。`.agents\skills` 并非通用目录，仅 OpenCode / Cursor / Cline / Amp / Kimi / Gemini CLI / GitHub Copilot 等会读取，**Claude Code 与 Codex 默认不读**。不确定时用 `--dir` 指定，或让该智能体自行安装。
+在 GitHub 仓库 `YottaMeta/yotta-vetter` 点 **Code → Download ZIP**，解压后把 `yotta-vetter` 文件夹放进智能体技能目录。
+
+### 方式四：install.sh（多智能体一键脚本）
+
+```text
+bash install.sh --agent <name>   # 装到指定智能体默认用户级目录
+bash install.sh --dir <path>     # 装到指定目录
+bash install.sh --list           # 列出智能体 -> 默认目录
+```
 
+> 方式一走 npm 源（npmmirror / npmjs），不依赖 GitHub；方式二 / 三走 GitHub，国内无代理可能失败。
 ## 升级 / 卸载
 
-- **升级**：重新安装最新版覆盖即可——`npx -y @yottameta/yotta-vetter -g` 或重跑 `bash install.sh -g`。技能目录内的旧文件会被覆盖；不影响项目中已有的其他文件。
+- **升级**：重新安装最新版覆盖即可——重跑你用的安装命令（如 `npx -y @yottameta/yotta-vetter --agent <name>` 或 `bash install.sh --agent <name>`）。技能目录内旧文件会被替换；不影响项目中其他文件。
 - **卸载**：删除目标智能体 skills 目录下的 `yotta-vetter` 文件夹（各智能体目录见上表）即可。卸载后本技能不再生效。
 
 ## 常见问题
@@ -153,4 +142,4 @@ bash install.sh --dir /path/to/skills
 
 ## 许可证
 
-MIT © YottaMeta —— 详见 [LICENSE](./LICENSE)。品牌声明见 [NOTICE](./NOTICE)。上游来源致谢：审查协议参考开源社区 skill-vetter 类技能思路，实现为 YottaMeta 自有。
+MIT © YottaMeta —— 详见 [LICENSE](./LICENSE)。品牌声明见 [NOTICE](./NOTICE)。来源声明：本技能由 YottaMeta 全新实现（零依赖自研 + 中文教学）。

package/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: yotta-vetter
-version: 0.1.4
+version: 0.2.2
 description: 元审 —— 安装任何技能前的安全审查协议：四阶段 checklist（来源→代码→权限→风险）+ 轻量 checker，与元安联动深度扫描。触发：安装/评估任何技能前、从市场或 GitHub 获取技能、审查他人分享的技能、任何「要装未知代码」的场景；或用户说 审查/审查技能/vetting/技能安全审查/检查技能 等。边界：checker 只做初审与报告，结论需人工确认；绝不代替最终决策。
 license: MIT
 ---

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yottameta/yotta-vetter",
-  "version": "0.1.4",
+  "version": "0.2.2",
   "description": "Yuanshen (元审) — the security review protocol before installing any skill: a four-phase checklist (source → code → permissions → risk) + a lightweight checker, with deep-scan handoff to yotta-security-audit. Triggers before installing/evaluating any skill or reviewing unknown code. Boundaries: initial review & report only; human confirmation required.",
   "license": "MIT",
   "keywords": [
@@ -22,7 +22,10 @@
     "scripts",
     "assets",
     "bin",
-    "README.zh-CN.md"
+    "README.zh-CN.md",
+    "!**/__pycache__",
+    "!**/*.pyc",
+    "!scripts/test_*.py"
   ],
   "repository": {
     "type": "git",

package/references/checklist.md

@@ -14,6 +14,7 @@
 - [ ] SKILL.md 存在，frontmatter name 与目录名一致
 - [ ] 描述清晰、版本号有、目录结构合理
 - [ ] 危险模式扫描：下载后执行 / 动态求值 / 数据外传 / 凭据访问 / 持久化 / 提权 / 混淆
+- [ ] 威胁捕获 8 检测点：供应链 / 命令执行 / 网络请求与数据外传 / 文件操作与敏感路径访问 / Prompt 注入 / 远程脚本下载执行 / 可疑编码·混淆 / 其他安全风险
 - [ ] 安装钩子：npm 生命周期脚本、安装自定义命令类
 - [ ] 隐藏字符：零宽字符、双向覆盖字符
 - [ ] 依赖声明与必要性

package/references/vetting-report-template.md

@@ -17,6 +17,24 @@ check --report 生成的报告遵循本结构；人工审查也可直接套用
 - 风险等级: <LOW / MEDIUM / HIGH / CRITICAL>
 - 结论: <SAFE TO INSTALL / REVIEW REQUIRED / INSTALL WITH CAUTION / DO NOT INSTALL>
 - 决策记录: <一句决策理由>
+- 安全健康度评分: <0-100>
+
+## 威胁捕获模型视图（8 类）
+
+| 检测点 | verdict | 命中 |
+|---|---|---|
+| 供应链风险 | <safe / suspicious / danger / n/a> | N |
+| 命令执行风险 | <safe / suspicious / danger / n/a> | N |
+| 网络请求与数据外传 | <safe / suspicious / danger / n/a> | N |
+| 文件操作与敏感路径访问 | <safe / suspicious / danger / n/a> | N |
+| Prompt 注入风险 | <safe / suspicious / danger / n/a> | N |
+| 远程脚本下载执行 | <safe / suspicious / danger / n/a> | N |
+| 可疑编码·混淆 | <safe / suspicious / danger / n/a> | N |
+| 其他安全风险 | <safe / suspicious / danger / n/a> | N |
+
+## 行为项（13 项）
+
+观察到：<行为项清单 / 未观察到明显系统行为>
 
 ## 汇总
 

package/scripts/vetter_rules.py

@@ -47,7 +47,7 @@ PATTERN_RULES = [
     # ── Obfuscation 混淆执行 ──────────────────────────────────────────────
     Rule("OBF-001", "Obfuscation", "high",
          r"\beval\s*\(\s*[^\"'\x600-9]",
-         "eval 传入非字面量参数（可能执行外部输入）", 80),
+         "eval 传入非字面量参数（可能执行不可信输入）", 80),
     Rule("OBF-002", "Obfuscation", "high",
          r"(?<!\.)\bexec\s*\(\s*[^\"'\x600-9]",
          "exec 传入非字面量参数", 80),
@@ -198,6 +198,32 @@ PATTERN_RULES = [
     Rule("SOC-002", "SocialEngineering", "medium",
          r"(?i)(?:metamask|wallet|private\s+key\s+backup|助记词|钱包)",
          "加密货币钱包相关命名", 55),
+    # ── PathTraversal 路径穿越（2026-08-30 增强：文件操作与敏感路径访问）────
+    Rule("PTV-001", "PathTraversal", "high",
+         r"(?i)(?:open|read|write|unlink|remove|rename|shutil\.copy|Path|path\.join|os\.path\.join)\s*\([^)]*\.\.(?:/|\\)",
+         "文件操作路径含父目录逃逸段，可能越权访问任意路径", 85),
+    Rule("PTV-002", "PathTraversal", "high",
+         r"(?i)(?:join|resolve|abspath|realpath)\s*\([^)]*\.\.(?:/|\\)",
+         "路径 join/解析未归一化父目录段，存在穿越风险", 80),
+
+    # ── MCPCommandExec MCP 工具面命令执行（2026-08-30 增强：命令执行风险）──
+    Rule("MCE-001", "MCPCommandExec", "critical",
+         r"(?i)(?:child_process\.)?(?:spawn|exec|execFile|fork)\s*\(\s*(?:params|tool_params|arguments|args|argv|input|command|user_input|req\.params|query|model)",
+         "MCP/工具参数流入子进程执行（spawn/exec/fork）", 92),
+    Rule("MCE-002", "MCPCommandExec", "critical",
+         r"(?i)(?:spawnSync|execSync)\s*\(\s*(?:params\.get|params\[|arguments\[|req\.params|user_input)",
+         "MCP 工具参数对象直接流入同步子进程执行（spawnSync/execSync）", 95),
+    Rule("MCE-003", "MCPCommandExec", "critical",
+         r"(?i)(?:subprocess\.)?(?:Popen|call|run)\s*\([^)]*shell\s*=\s*True[^)]*(?:params|args|argv|input|command|user_input|cmd)",
+         "subprocess 以 shell=True 执行不可信输入", 92),
+
+    # ── MCPFileAccess MCP 工具面任意文件读写（2026-08-30 增强：文件操作）───
+    Rule("MFA-001", "MCPFileAccess", "high",
+         r"(?i)(?:fs\.)?(?:writeFile|writeFileSync|appendFile|createWriteStream)\s*\(\s*(?:params\.get|params\[|arguments\[|req\.params|user_input)",
+         "MCP 工具参数对象直接流入文件写操作（任意路径写入风险）", 88),
+    Rule("MFA-002", "MCPFileAccess", "high",
+         r"(?i)(?:fs\.)?(?:readFile|readFileSync|createReadStream)\s*\(\s*(?:params\.get|params\[|arguments\[|req\.params|user_input)",
+         "MCP 工具参数对象直接流入文件读操作（任意路径读取风险）", 88),
 ]
 
 # 敏感文件名（文件名级匹配，CredentialTheft 辅助）
@@ -212,6 +238,69 @@ SENSITIVE_FILENAMES = [
     (".env", "环境变量文件", "medium", 45),
 ]
 
+# ══════════════════════════════════════════════════════════════════════════
+# 威胁捕获模型（2026-08-30 增强：8 检测点 + 13 行为项口径）
+# ══════════════════════════════════════════════════════════════════════════
+# 官方 8 检测点（2026-08-30）
+THREAT_TAXONOMY = {
+    "supply_chain": "供应链风险",
+    "command_execution": "命令执行风险",
+    "network_exfil": "网络请求与数据外传",
+    "file_access": "文件操作与敏感路径访问",
+    "prompt_injection": "Prompt 注入风险",
+    "remote_download": "远程脚本下载执行",
+    "obfuscation": "可疑编码/混淆",
+    "other": "其他安全风险",
+}
+TAXONOMY_ORDER = ("supply_chain", "command_execution", "network_exfil", "file_access",
+                  "prompt_injection", "remote_download", "obfuscation", "other")
+
+# detector → 官方 8 检测点
+DETECTOR_TO_TAXONOMY = {
+    "DownloadExec": "remote_download",
+    "Obfuscation": "obfuscation",
+    "Persistence": "other",
+    "Exfiltration": "network_exfil",
+    "CredentialTheft": "file_access",
+    "NetworkCall": "network_exfil",
+    "PrivilegeEscalation": "other",
+    "SocialEngineering": "other",
+    "PromptInjection": "prompt_injection",
+    "PathTraversal": "file_access",
+    "MCPCommandExec": "command_execution",
+    "MCPFileAccess": "file_access",
+    "Structure": "other",
+    "Permission": "other",
+    "MCPToolSurface": "command_execution",
+}
+
+# 13 行为项（2026-08-30）
+BEHAVIORS = (
+    "安装依赖包", "收集系统信息", "收集用户信息", "创建定时任务", "DNS 查询", "写入文件",
+    "HTTP 请求", "读取环境变量", "收集网络配置信息", "写入配置文件", "调用远端 API",
+    "读取文件", "修改 AI 配置",
+)
+
+# detector → 行为项（一/多个；攻击模式类如注入/混淆不映射具体行为）
+DETECTOR_TO_BEHAVIORS = {
+    "DownloadExec": ("安装依赖包", "HTTP 请求"),
+    "Obfuscation": (),
+    "Persistence": ("创建定时任务", "写入配置文件"),
+    "Exfiltration": ("HTTP 请求", "调用远端 API"),
+    "CredentialTheft": ("读取文件", "收集用户信息"),
+    "NetworkCall": ("DNS 查询", "HTTP 请求", "调用远端 API"),
+    "PrivilegeEscalation": ("修改 AI 配置",),
+    "SocialEngineering": (),
+    "PromptInjection": (),
+    "PathTraversal": ("读取文件", "写入文件"),
+    "MCPCommandExec": (),
+    "MCPFileAccess": ("读取文件", "写入文件"),
+    "Structure": (),
+    "Permission": (),
+    "MCPToolSurface": (),
+}
+
+
 # 外传敏感文件组合（EXF 规则之外的补充，按文件名 + 行内网络调用）
 # 安装钩子可疑关键字（yotta_audit.py PostInstallHookDetector 使用；本文件为签名数据，自扫豁免）
 POSTINSTALL_SUSPICIOUS = r"(?i)(curl|wget|bash|sh\s|python|node\s+-e|eval|powershell|/tmp|%temp%)"

package/scripts/yotta_vetter.py

@@ -48,7 +48,7 @@ _HERE = Path(__file__).resolve().parent
 sys.path.insert(0, str(_HERE))
 import vetter_rules  # noqa: E402
 
-VERSION = "0.1.4"
+VERSION = "0.2.2"
 TOOL_NAME = "yotta-vetter"
 MAX_FILE_SIZE = 1_000_000
 MAX_LINE_LEN = vetter_rules.MAX_LINE_LEN
@@ -125,7 +125,7 @@ def collect_files(root):
             try:
                 if p.suffix.lower() not in TEXT_EXTENSIONS and p.name.lower() not in DOTFILE_NAMES:
                     continue
-                if p.name in ("audit_rules.py", "vetter_rules.py", "verify_rules.py"):
+                if p.name in ("audit_rules.py", "vetter_rules.py", "verify_rules.py", "hardening_rules.py"):
                     continue  # 签名数据文件（规则表）
                 if p.stat().st_size > MAX_FILE_SIZE:
                     continue
@@ -198,7 +198,7 @@ def inventory_checks(root, files):
                     "Inventory", "low", "permissions", str(p),
                     description="非脚本文件带可执行位", confidence=40,
                     rule_id="PERM-002"))
-    # 符号链接（可能指向外部）
+    # 符号链接（可能指向目录外）
     for p in files:
         if p.is_symlink():
             findings.append(Finding("Inventory", "medium", "permissions", str(p),
@@ -265,6 +265,55 @@ def verdict_for(worst):
         return "REVIEW REQUIRED", "发现 medium 级风险，建议复核后安装"
     return "SAFE TO INSTALL", "未发现明显风险（仍建议按协议完整审查）"
 
+# ── 威胁捕获模型视图（2026-08-30 增强：8 检测点 + 13 行为项）────────
+_SEV_WEIGHT = {"critical": 40, "high": 20, "medium": 8, "low": 1, "info": 0}
+_SEV_CAPS = {"critical": 2, "high": 4, "medium": 6, "low": 10, "info": 0}
+
+
+def _health_score(findings):
+    counts = {}
+    for f in findings:
+        counts[f.severity] = counts.get(f.severity, 0) + 1
+    score = 100
+    for sev, w in _SEV_WEIGHT.items():
+        score -= w * min(counts.get(sev, 0), _SEV_CAPS[sev])
+    return max(0, int(round(score)))
+
+
+def _taxonomy_view(findings):
+    hits = {}
+    for f in findings:
+        key = vetter_rules.DETECTOR_TO_TAXONOMY.get(f.detector, "other")
+        hits.setdefault(key, []).append(f)
+    out = []
+    for key in vetter_rules.TAXONOMY_ORDER:
+        items = hits.get(key, [])
+        name = vetter_rules.THREAT_TAXONOMY.get(key, key)
+        sev = "info"
+        for f in items:
+            if _SEV_WEIGHT.get(f.severity, 0) > _SEV_WEIGHT.get(sev, 0):
+                sev = f.severity
+        if not items:
+            verdict = "n/a"
+        elif sev in ("critical", "high"):
+            verdict = "danger"
+        elif sev == "medium":
+            verdict = "suspicious"
+        else:
+            verdict = "safe"
+        out.append({"name": name, "verdict": verdict, "count": len(items)})
+    return out
+
+
+def _behavior_view(findings):
+    observed = {}
+    for f in findings:
+        for b in vetter_rules.DETECTOR_TO_BEHAVIORS.get(f.detector, ()):
+            observed[b] = observed.get(b, 0) + 1
+    return [{"behavior": b, "observed": observed.get(b, 0)}
+            for b in vetter_rules.BEHAVIORS]
+
+
 # ── 输出（文本 / JSON / 报告）──────────────────────────────────────────────
 
 def fmt_report(findings, scope):
@@ -289,6 +338,15 @@ def fmt_report(findings, scope):
     lines.append("风险等级: %s" % _worst(findings).upper())
     lines.append("结论: %s" % verdict)
     lines.append("决策记录: %s" % note)
+    lines.append("安全健康度评分: %d/100" % _health_score(findings))
+    lines.append("")
+    lines.append("威胁捕获模型（8 类）：")
+    for v in _taxonomy_view(findings):
+        lines.append("  %-16s %-11s %d" % (v["name"], v["verdict"], v["count"]))
+    lines.append("")
+    observed = [b["behavior"] for b in _behavior_view(findings) if b["observed"]]
+    lines.append("行为项（13 项）：%s" % (
+        "、".join(observed) if observed else "未观察到明显系统行为"))
     lines.append("")
     if findings:
         lines.append("发现:")
@@ -333,6 +391,20 @@ def write_report_md(path, findings, scope):
     for sev in _SEVERITY_ORDER:
         lines.append("| %s | %d |" % (sev.upper(), counts[sev]))
     lines.append("")
+    lines.append("**安全健康度评分：%d/100**" % _health_score(findings))
+    lines.append("")
+    lines.append("## 威胁捕获模型视图（8 类）")
+    lines.append("")
+    lines.append("| 检测点 | verdict | 命中 |")
+    lines.append("|---|---|---|")
+    for v in _taxonomy_view(findings):
+        lines.append("| %s | %s | %d |" % (v["name"], v["verdict"], v["count"]))
+    lines.append("")
+    lines.append("## 行为项（13 项）")
+    lines.append("")
+    observed = [b["behavior"] for b in _behavior_view(findings) if b["observed"]]
+    lines.append("观察到：%s" % ("、".join(observed) if observed else "未观察到明显系统行为"))
+    lines.append("")
     if findings:
         lines.append("## 发现")
         lines.append("")
@@ -388,6 +460,11 @@ def cmd_check(args):
             "tool": TOOL_NAME, "version": VERSION, "scope": scope,
             "summary": _summary(findings),
             "findings": [f.to_dict() for f in findings],
+            "threat": {
+                "health_score": _health_score(findings),
+                "taxonomy": _taxonomy_view(findings),
+                "behaviors": _behavior_view(findings),
+            },
         }, indent=2, ensure_ascii=False))
     else:
         print(fmt_report(findings, scope))

package/scripts/test_yotta_vetter.py

@@ -1,111 +0,0 @@
-# -*- coding: utf-8 -*-
-"""yotta-vetter（元审）测试套件。
-
-用法：
-  python3 scripts/test_yotta_vetter.py
-覆盖：check 干净/恶意/自扫、四阶段清单、JSON 与报告、严重级过滤、
-V3 元安联动、source 来源检查（格式/404 降级）、GBK 控制台加固。
-"""
-import json
-import os
-import subprocess
-import sys
-import tempfile
-import unittest
-from pathlib import Path
-
-HERE = Path(__file__).resolve().parent
-SCRIPT = HERE / "yotta_vetter.py"
-FIX = HERE.parent.parent.parent / ".tmp" / "audit-fixtures"
-
-
-def run_cli(args, env=None):
-    full = dict(os.environ)
-    if env:
-        full.update(env)
-    return subprocess.run(
-        [sys.executable, str(SCRIPT)] + args,
-        capture_output=True, text=True, encoding="utf-8", errors="replace",
-        env=full, timeout=60,
-    )
-
-
-class VetterCliTest(unittest.TestCase):
-    def test_check_clean(self):
-        r = run_cli(["check", str(FIX / "clean-skill"), "--no-color"])
-        self.assertEqual(r.returncode, 0, r.stdout + r.stderr)
-        self.assertIn("SAFE TO INSTALL", r.stdout)
-
-    def test_check_evil_verdict_and_linkage(self):
-        r = run_cli(["check", str(FIX / "evil-skill"), "--no-color"])
-        self.assertEqual(r.returncode, 3, r.stdout + r.stderr)
-        self.assertIn("DO NOT INSTALL", r.stdout)
-        self.assertIn("yotta-security-audit --target skill", r.stderr)  # V3 联动
-
-    def test_check_self_no_high_critical(self):
-        """自扫：无 high/critical（urllib 来源检查为预期 medium，规则表已豁免）。"""
-        r = run_cli(["check", str(SCRIPT.parent), "--no-color"])
-        self.assertIn(r.returncode, (0, 1), r.stdout + r.stderr)
-        self.assertNotIn("[HIGH]", r.stdout)
-        self.assertNotIn("[CRITICAL]", r.stdout)
-
-    def test_check_missing_path_exit4(self):
-        r = run_cli(["check", "C:/definitely/not/exists"])
-        self.assertEqual(r.returncode, 4, r.stdout + r.stderr)
-
-    def test_check_json(self):
-        r = run_cli(["check", str(FIX / "evil-skill"), "--json"])
-        self.assertEqual(r.returncode, 3, r.stderr)
-        data = json.loads(r.stdout)
-        self.assertEqual(data["tool"], "yotta-vetter")
-        self.assertGreaterEqual(data["summary"]["critical"], 1)
-        self.assertTrue(all("rule_id" in f for f in data["findings"]))
-
-    def test_check_report_md(self):
-        with tempfile.TemporaryDirectory() as td:
-            rep = Path(td) / "vetting-report.md"
-            r = run_cli(["check", str(FIX / "evil-skill"), "--report", str(rep)])
-            self.assertEqual(r.returncode, 3, r.stderr)
-            self.assertTrue(rep.exists())
-            txt = rep.read_text(encoding="utf-8")
-            self.assertIn("SKILL VETTING REPORT", txt)
-            self.assertIn("决策记录", txt)
-
-    def test_check_severity_filter(self):
-        r = run_cli(["check", str(FIX / "evil-skill"),
-                     "--severity", "critical", "--no-color"])
-        self.assertEqual(r.returncode, 3, r.stderr)
-        self.assertNotIn("[MEDIUM]", r.stdout)
-
-    def test_inventory_missing_skill_md(self):
-        with tempfile.TemporaryDirectory() as td:
-            Path(td, "README.md").write_text("no skill", encoding="utf-8")
-            r = run_cli(["check", td, "--no-color"])
-            self.assertIn("缺少 SKILL.md", r.stdout)
-
-    def test_source_bad_format_exit4(self):
-        r = run_cli(["source", "not-a-slash-spec"])
-        self.assertEqual(r.returncode, 4, r.stdout + r.stderr)
-
-    def test_source_missing_repo_exit1(self):
-        r = run_cli(["source", "github:YottaMeta/__no_such_repo_xyz__"])
-        self.assertEqual(r.returncode, 1, r.stdout + r.stderr)
-
-    def test_bad_command_exit4(self):
-        r = run_cli(["frobnicate"])
-        self.assertEqual(r.returncode, 4, r.stdout + r.stderr)
-
-    def test_gbk_console_no_crash(self):
-        env = dict(os.environ)
-        env["PYTHONIOENCODING"] = "gbk"
-        r = subprocess.run(
-            [sys.executable, str(SCRIPT), "check", str(FIX / "clean-skill"), "--no-color"],
-            capture_output=True, env=env, timeout=60)
-        self.assertEqual(r.returncode, 0, r.stderr.decode("gbk", errors="replace"))
-        self.assertNotIn(b"UnicodeEncodeError", r.stderr)
-
-
-if __name__ == "__main__":
-    suite = unittest.defaultTestLoader.loadTestsFromModule(sys.modules[__name__])
-    ok = unittest.TextTestRunner(verbosity=2).run(suite).wasSuccessful()
-    sys.exit(0 if ok else 1)