元信 yotta-verify

元信 —— 装任何技能/包前的确定性安全扫描器：prompt injection（提示注入）+ 危险模式 + SKILL.md 完整性 + 权限需求，输出 verdict（SAFE TO INSTALL / INSTALL WITH CAUTION / REVIEW REQUIRED / DO NOT INSTALL）+ audited 徽章。触发：安装/评估任何技能或 npm 包前、给技能做安全验证、生成 audited 徽章、CI 装前闸门；或用户说装前扫描/验证/audited/安全验证/verify-skill/可信等。边界：只做确定性静态扫描与报告，不执行被测代码、不联网、不装包

as observed 2026-10-02T07:46:18.975Z

Identifier: yotta-verify
Source: ClawHub
Version observed: 0.3.4
Source repository: not published
Repository observation: No source repository listed
First observed here: 2026-08-28T22:06:26.689Z
Observations recorded: 9
Installs (reported upstream): 2
Weekly downloads (upstream): 617
Declared license: MIT-0

Observation history

2026-10-02T07:46:18.975Z

Fields that differed: changelog latestVersion

Field	Before	After
`changelog`	"yotta-verify 0.3.3\n\n- Enhanced self-scan: rule exemption now requires both file path and SHA-256 of contents to match (improves security; see SKILL.md \"自扫说明\").\n- Refined docu	"yotta-verify v0.3.4\n\n- Documentation updated: SKILL.md, README.md, README.zh-CN.md, and CHANGELOG.md revised for clarity and up-to-date content.\n- Internal scripts and metadata
`latestVersion`	"0.3.3"	"0.3.4"

2026-09-26T01:46:07.395Z

Fields that differed: changelog latestVersion

Field	Before	After
`changelog`	"v0.3.1：修复 npm tarball / package 根的 STR-004 误报；tarball 解压拒绝符号链接、硬链接与特殊成员。"	"yotta-verify 0.3.3\n\n- Enhanced self-scan: rule exemption now requires both file path and SHA-256 of contents to match (improves security; see SKILL.md \"自扫说明\").\n- Refined docu
`latestVersion`	"0.3.1"	"0.3.3"

2026-09-17T19:21:47.048Z

Fields that differed: license description

Field	Before	After
`license`	null	"MIT-0"
`description`	"元信 —— 装任何技能/包前的确定性安全扫描器：prompt injection（提示注入）+ 危险模式 + SKILL.md 完整性 + 权限需求，输出 verdict（SAFE TO INSTALL / INSTALL WITH CAUTION / REVIEW REQUIRED / DO NOT INSTALL）+ audited 徽章。触发：安装/	null

2026-09-14T16:18:15.028Z

Fields that differed: changelog latestVersion topics

Field	Before	After
`changelog`	"yotta-verify 0.3.0\n\n- 新增 skill-manifest.json 支持，配合元阁安装链路 before_install 阶段集成，实现扫描不通过时阻断更新与本地证据日志。\n- 文档重大更新，完善 README.md、README.zh-CN.md，明确安装链与扫描集成说明。\n- 移除 skill-card.md 文件，统一核	"v0.3.1：修复 npm tarball / package 根的 STR-004 误报；tarball 解压拒绝符号链接、硬链接与特殊成员。"
`latestVersion`	"0.3.0"	"0.3.1"
`topics`	["供应链安全","安全验证","审计徽章","技能安全","装前扫描"]	["security","供应链安全","安全验证","技能安全","装前扫描"]

2026-09-13T15:17:50.529Z

Fields that differed: changelog latestVersion

Field	Before	After
`changelog`	"- Removed the file skill-card.md from the package.\n- No other user-facing changes; all features and documentation remain the same."	"yotta-verify 0.3.0\n\n- 新增 skill-manifest.json 支持，配合元阁安装链路 before_install 阶段集成，实现扫描不通过时阻断更新与本地证据日志。\n- 文档重大更新，完善 README.md、README.zh-CN.md，明确安装链与扫描集成说明。\n- 移除 skill-card.md 文件，统一核
`latestVersion`	"0.2.3"	"0.3.0"

2026-09-03T07:20:35.503Z

Fields that differed: changelog latestVersion topics

Field	Before	After
`changelog`	"v0.2.2 措辞规范：正文不再写版本号、统一对外表述；删除 Pro 分层代码"	"- Removed the file skill-card.md from the package.\n- No other user-facing changes; all features and documentation remain the same."
`latestVersion`	"0.2.2"	"0.2.3"
`topics`	["security verify"]	["供应链安全","安全验证","审计徽章","技能安全","装前扫描"]

2026-08-31T05:56:02.430Z

Fields that differed: changelog latestVersion topics

Field	Before	After
`changelog`	"yotta-verify 0.1.1 维护性修复：SIGNATURE_DATA_FILES 增加 hardening_rules.py（元安规则表），扫描元安（yotta-agent-hardening）仓库时不再把规则签名表误报为被测代码。"	"v0.2.2 措辞规范：正文不再写版本号、统一对外表述；删除 Pro 分层代码"
`latestVersion`	"0.1.1"	"0.2.2"
`topics`	[]	["security verify"]

2026-08-29T23:02:09.653Z

Fields that differed: changelog latestVersion

Field	Before	After
`changelog`	"yotta-verify 0.1.0 初始版本发布：\n\n- 提供技能/包装前的确定性安全扫描（prompt injection、危险模式、SKILL.md 完整性、权限需求）。\n- 输出一句话 verdict（SAFE TO INSTALL / INSTALL WITH CAUTION / REVIEW REQUIRED / DO NOT INSTA	"yotta-verify 0.1.1 维护性修复：SIGNATURE_DATA_FILES 增加 hardening_rules.py（元安规则表），扫描元安（yotta-agent-hardening）仓库时不再把规则签名表误报为被测代码。"
`latestVersion`	"0.1.0"	"0.1.1"

Correction

If you maintain this extension and believe anything above is inaccurate, request a correction. Corrections are published, and disputed entries are marked as disputed while under review.