cue-civil-appeal-turnaround

• Outcome: Review
• Latest audit: Oct 22, 2026 · 4:54 PM UTC
• Version: 0.3.9

Overview

This appeal-preparation skill needs review because its optional online check can expose an API key and its Word exporter can omit text.

The core workflow can run locally without an API key. Before enabling online helpers, independently verify the HTTPS destination and approve which confidential materials will be transmitted. Compare Word exports with their source documents, and have legal arguments and deadlines independently reviewed before filing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 179)May include surrounding context.

hon-docx -i https://pypi.tuna.tsinghua.edu.cn/simple`. Without it you simply get no .docx; everything else is unaffected, and the script reports the install command rather than degrading silently.

• Apart from the two optional auxiliaries above (cue-omni-reader for material, cue-research for statute and case leads) there is no other dependency: absent tools degrade without error, the user confirms before either is run, and the judgment plus materials come from the user - when material cannot get in, see the channel section at the end of section 2. What is lost is stated in the same sentence: scans cannot be read and the statute/case-lead leg is missing - the gap is channel evidence, not formatting.

The channel route on this face (this package ships no connectivity script - the curl lines below are the whole action; what they prove is catalog reachability and that your key is accepted, not that this skill fetched anything):

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 187)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 185)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 177)May include surrounding context.

• python-docx(可选,仅 scripts/export_docx.py 导出 Word 递交稿时需要):python -m pip install python-docx -i https://pypi.tuna.tsinghua.edu.cn/simple。不装只是不能出 docx,其余流程不受影响;脚本缺少该依赖时会明确报安装命令,不做静默降级。
• 除上面两条可选辅助(cue-omni-reader 解析素材、cue-research 列法条与类案候选)外无其他依赖:不装不报错,代价是扫描件读不进来、法条与类案线索缺一条腿(缺的是通道证据,不是排版);用前先经使用人确认,判决书与材料由使用人提供,素材进不来时见 §二 末「素材与线索的两条通道」。

通道侧的账户自查走这条正路(本包不随带自测脚本,下面两行 curl 就是全部动作;它证的是「目录可达」与「那把 key 被接受」,不替代本件的取数):

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 177)May include surrounding context.

• python-docx（可选，仅 scripts/export_docx.py 导出 Word 递交稿时需要）：python -m pip install python-docx -i https://pypi.tuna.tsinghua.edu.cn/simple。不装只是不能出 docx，其余流程不受影响；脚本缺少该依赖时会明确报安装命令，不做静默降级。
• 除上面两条可选辅助（cue-omni-reader 解析素材、cue-research 列法条与类案候选）外无其他依赖：不装不报错，代价是扫描件读不进来、法条与类案线索缺一条腿（缺的是通道证据，不是排版）；用前先经使用人确认，判决书与材料由使用人提供，素材进不来时见 §二 末「素材与线索的两条通道」。

通道侧的账户自查走这条正路（本包不随带自测脚本，下面两行 curl 就是全部动作；它证的是「目录可达」与「那把 key 被接受」，不替代本件的取数）：

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk implements remote service discovery and authenticated tool enumeration, not the declared civil-appeal workflow. Its network requests directly contradict the offline claim, and sending CUE_API_KEY to a catalog-selected endpoint is an undeclared credential-handling behavior. The chunk does not show litigation-document processing or evidence analysis. It lists tools rather than executing them, and there is no evidence in this chunk of document upload.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code performs remote service discovery and authenticated MCP tool listing, not judgment analysis or appeal preparation. These external API interactions materially contradict the declared offline operation and are not established as supporting implementation details for the stated purpose. The snippet does not demonstrate invocation of the discovered tools or transmission of legal documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Despite expressly excluding legal advice, the skill directs case-specific claim selection, litigation strategy, and procedural actions, including categorical deadline and preservation guidance. Self-represented users could rely on these instructions and lose procedural rights if they do not fit the applicable case; the verification requirements and confirmation gates reduce this risk but do not eliminate the contradiction.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

The evidence-parsing workflow lacks a warning about disclosing sensitive case materials to an external service.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The optional parsing workflow can send sensitive litigation evidence to an external service without explicitly explaining that disclosure or requiring pre-upload minimization. User confirmation before invoking the auxiliary and redaction of generated outputs are useful safeguards, but neither establishes informed consent for uploading original recordings, identity information, or confidential case records.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The command executes an unpinned npm CLI and installs skill content from a repository without specifying an immutable revision. Although this is not an MCP server declaration, it creates a supply-chain exposure: compromised or changed upstream content could execute with local permissions or introduce malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx line'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 125)May include surrounding context.

bash

# 1. Fallback: manual placement when there is no CLI (the primary route is the npx line above)
mkdir -p ~/.workbuddy/skills
cp -r civil-appeal-turnaround ~/.workbuddy/skills/

# 2. Initialise a case working directory (five tables + master / report / appeal / pack skeletons + day-one three actions)

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The command attaches CUE_API_KEY to a destination selected directly from a remotely supplied catalog, without validating the URL scheme or credential audience. If the catalog or its routing data is compromised, the bearer token could be sent to an attacker-controlled host or over plaintext HTTP; choosing a listed domain ID does not independently authenticate the destination.

Content

Scanner excerpt · README.en.md (reported line 192)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "no value: ROUTING_URL is empty - list the ids first, then set DOMAIN_ID to one of them" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

The optional evidence-parsing workflow lacks a warning about sending sensitive case materials to an external service.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The optional parsing workflow encourages processing court files, recordings, and other evidence through an external service without explicitly explaining the sensitive-data disclosure or requiring informed consent to that disclosure. General confirmation to use an optional tool and redaction of final outputs do not protect raw uploaded materials, which may contain financial details, identifiers, or confidential communications.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 87% confidence

Finding

The installation command invokes an unpinned npm executable and installs skill content from a mutable repository reference. Although this is an installer rather than an MCP server, a compromised future package or repository revision could introduce executable code or malicious agent instructions into a workflow handling sensitive litigation materials.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 123)May include surrounding context.

bash

# 1. 兜底：无 CLI 环境时手工放件（主路是上面那条 npx）
mkdir -p ~/.workbuddy/skills
cp -r civil-appeal-turnaround ~/.workbuddy/skills/

# 2. 初始化一个案件工作目录（生成五张表 + 主控/复核/上诉状/配套文书包骨架 + 今日三件事.txt）

The claimed offline, self-contained skill includes executable API connectivity and authentication checks.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The manifest and L151 describe this skill's scripts and workflow as offline and making no API calls. However, the README supplies its own commands that query an external catalog and send an authenticated JSON-RPC request to a catalog-provided endpoint; these commands run directly rather than delegating to either separately installed optional helper.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The command sends CUE_API_KEY to a routing URL taken from a remote catalog without validating its scheme, hostname, or authorization to receive that credential. A compromised or misconfigured catalog could redirect the token to an attacker-controlled endpoint or an unencrypted HTTP endpoint; HTTPS on the catalog itself does not establish trust in every destination it lists.

Content

Scanner excerpt · README.md (reported line 190)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

The documentation denies credential reads although the supplied command reads and transmits an API key.

Medium

• Category: Excessive Agency
• Confidence: 93% confidence

Finding

L197 states that this block adds no credential-reading actions. In fact, L191 expands the CUE_API_KEY environment variable and includes its value in the Authorization header of an external request, contradicting that assurance even though it does not print the key to the terminal.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The skill supplies a categorical legal-liability conclusion despite explicitly excluding legal advice.

Medium

• Category: Excessive Agency
• Confidence: 94% confidence

Finding

The template categorically concludes that the organization must bear liability under either alternative, although receipt of benefits or a cooperation agreement does not by itself establish all elements of agency, unjust enrichment, or another liability theory. In a skill designed to generate civil-appeal materials for self-represented litigants, this unsupported certainty could become a misleading legal argument and adversely affect litigation. The surrounding requirements to list elements and verify citations provide some mitigation, but neither they nor the legal-advice disclaimer qualify this substantive conclusion.

Content

No source excerpt is available for this finding.

Table rendering silently discards cells beyond the header width, contradicting the documented verbatim-preservation guarantee.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The renderer fixes the table width to the header length and copies only that many cells from each row, silently discarding any additional cells. An attacker-controlled or accidentally malformed Markdown table could therefore omit material evidence, qualifications, or claims from the exported court document despite the stated verbatim-preservation guarantee. The legal-filing context increases the consequences, and the optional fidelity check is insufficient protection because detected omissions only produce warnings without failing the export.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.