ClawHub
Back to skill

Security audit

公告速览·A股

Security checks for vulnerabilities and agentic risk

Overview

The skill’s announcement summaries, optional Cue connection, and local checks fit its stated purpose, with privacy and installation precautions.

Cue queries can reveal which companies interest you; use supplied filings if that matters. Keep the API key out of chat and verify provider destinations use HTTPS before authenticating. Review and pin optional installers and skills separately; their code and live service behavior were outside this package review.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (13)

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash
# 1. drop it into the skills directory
mkdir -p ~/.workbuddy/skills
cp -r announcement-daily-cn ~/.workbuddy/skills/

# 2. ask the agent for the four-section list defined in SKILL.md §3, save it as my-digest.md

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash
# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r announcement-daily-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的 §3 四段出清单，产物存成我的速览.md

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command executes an unpinned npm CLI and retrieves skill content from a mutable repository reference. Although this is an installation example rather than an MCP server declaration, compromised upstream releases could introduce code or agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The whole-set installation uses an unpinned executable and mutable third-party skill content. A compromised dependency could affect the agent's retrieval and parsing workflows; interactive selection does not establish package integrity.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Selecting a specific skill reduces installation scope but does not pin the CLI or downloaded repository content. Upstream compromise could therefore introduce malicious executable code or agent instructions during installation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Authentication to the intended provider is legitimate, but the example sends the API key to a catalog-derived URL without requiring an approved HTTPS destination. A compromised or misconfigured catalog could redirect the credential to an attacker-controlled host, and the command does not itself prevent plaintext HTTP.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take the domain's routing.url and transport from that response; do not copy the host into a config by hand

3) with a key, send tools/list — proves only that this data-leg endpoint accepts the key, and proves nothing about other entries

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command uses an unpinned npm CLI and a mutable skill repository reference. This creates a supply-chain exposure even though the matched text is an installer rather than an MCP server configuration.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The whole-set command can execute a changing CLI and install changing third-party skill content. A compromised upstream release could consequently affect an agent workflow that accesses local inputs and provider credentials.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The single-skill selector limits what is installed but leaves both installer execution and repository content unpinned. A malicious upstream update could still introduce hostile code or instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

The request legitimately authenticates to a data service, but its destination is taken from a live catalog without an independent origin or HTTPS check. If that routing data is compromised or misconfigured, the bearer key could be transmitted to an unintended destination.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The external data-retrieval workflow lacks a warning that company/watchlist queries are shared with a third-party provider.

Medium
Category
Output Handling
Confidence
92% confidence
Finding

The retrieval workflow sends company identifiers or watchlist-derived queries to a third-party provider without explicitly explaining that disclosure. Public filings are not sensitive themselves, but a user's selection of companies can reveal private holdings, research interests, or investment strategy.

Content

No source excerpt is available for this finding.

The self-test enumerates the shared temporary directory despite the explicit claim that the script does not read directories.

Low
Category
Excessive Agency
Confidence
98% confidence
Finding

The CLI documentation at L170 states “本件不读网络、不读目录” (no network or directory reads), but L157 calls root.iterdir() on the system temporary directory. This examines entries beyond the self-test's own tracked temporary roots and can count unrelated check-digest-* directories as leftovers.

Content

No source excerpt is available for this finding.