Security audit
Security checks for vulnerabilities and agentic risk
The skill’s bond-document workflow fits its stated purpose, with ordinary installation risks and privacy considerations for optional online parsing.
Prefer the reviewed package or pinned installation sources, and review optional companion skills separately. Keep API keys out of chat and verify the provider’s HTTPS destination before authentication. Use public or approved documents for online parsing; keep confidential material local unless the processor’s handling and retention are acceptable. External service implementations and retention were not verified.
该代码片段的直接用途是 MCP 服务发现与认证连通性检查，未体现债券文档解析、八项条款提取、逐字引用或定位锚点生成。代码也未建立这些网络操作与所声明债券分析任务之间的关联，因此不能将其视为已说明的配套实现细节。API 密钥被用作请求的认证凭据；仅凭此片段不能断定存在恶意窃取，但这些外部访问和工具枚举行为与声明用途存在实质不符。
该代码块的实际功能是远程 MCP 服务发现和连接诊断，没有读取债券文件、提取八项条款或生成带原句锚点的条款卡。虽然网络调用可能是某些技能的辅助实现，但这里没有体现这些操作与所声明债券处理任务的关联，因此所示行为与声明用途存在实质不符。代码将密钥发送至变量指定的端点，但没有足够证据认定其属于恶意泄露。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.workbuddy/skills
cp -r bond-terms-cn ~/.workbuddy/skills/
# ask the agent for the five-section card defined in SKILL.md, save it as my-bond-card.md
python3 ~/.workbuddy/skills/bond-terms-cn/scripts/check_bond_card.py ./my-bond-card.md
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r bond-terms-cn ~/.workbuddy/skills/
# 2. 让 agent 按 SKILL.md 的债券卡五段出卡，产物存成我的债券卡.md
The installation command runs an unpinned npm CLI and installs skill content from a mutable repository reference. Although this is not itself an MCP server declaration, compromised or unexpected upstream releases could execute code or install adversarial agent instructions.
The optional collection installation uses an unpinned executable and a mutable skill repository. This creates a supply-chain exposure during setup, though the supplied text does not establish malicious upstream content.
Selecting one skill narrows the installation scope but does not pin either the npm executable or repository content. An upstream compromise could therefore introduce executable code or persistent agent instructions during installation.
Authenticated tools/list discovery is legitimate, but the instructions send the API key to a catalog-selected URL without specifying HTTPS enforcement or an independently approved destination policy. If the catalog or routing value is compromised, the credential could be transmitted to an attacker-controlled endpoint; the request does not itself upload bond documents.
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400
The command uses an unpinned npm installer and mutable skill repository content. Although the scanner incorrectly describes the installer as an MCP server, the underlying installation supply-chain exposure is real.
The collection installer has no fixed executable version or repository revision. Its interactive selection limits what is installed but does not prevent compromised upstream releases from affecting setup.
The single-skill command still resolves an unpinned npm executable and mutable remote skill content. A compromised dependency or repository update could execute code or install unsafe agent instructions.
The connectivity test legitimately authenticates to a service, but its destination comes from catalog routing without a stated HTTPS or approved-origin validation step. A compromised routing response could redirect the bearer credential to an attacker, even though the request body contains only tools/list.
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400
The recovery instruction recommends external attachment parsing without explicitly warning that document content or access links may leave the user's environment. Prospectuses are often public, reducing typical exposure, but user-supplied drafts or annotated documents may contain confidential information.
The workflow sends attachments through an external parsing channel when needed, but does not explicitly disclose the document-data transfer or require approval for confidential inputs. Mentioning server billing and reporting parser use afterward does not establish informed consent before transmission.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow initiates external parsing when relevant quotations are in attachments, without an explicit warning or prior approval for transmitting user-provided material. Limiting parsing to needed sections reduces processing scope but does not ensure confidential documents or access links remain private.