现金流质量·逐条挂源

• Outcome: Review
• Latest audit: Nov 12, 2026 · 2:10 PM UTC
• Version: 0.2.1

Overview

The skill receives a suspicious verdict because scanners report undeclared local usage tracking and a weakness in how its cash-flow validator checks supporting evidence.

Consider the suspicious verdict and the reported validator weakness and undeclared local usage tracking before installing. The scan is marked partial because one local reference could not be resolved, so the available evidence is incomplete; it does not establish that the skill is safe or that the author acted maliciously.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (28)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 28)May include surrounding context.

md

- **为什么要有它：** 平台的两个下载计数器都不可信——新 listing 上架首 48 小时会一次性播种 50~60 的初始计数，那不是用户下载。本地这枚文件是本件唯一能证明「真有人装上并跑过」的证据。
- **规矩：** `try/except` 全包，任何失败（家目录只读、配额满、无 HOME）静默跳过——不报错、不改退码、不吐杂音。同一天跑多次只留一枚（`touch` 前先判存在）。
- 清掉：`rm -rf ~/.cue-usage`。

**三、退码补一格：缺参数由 `3` 改 `2`**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 152)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 152)May include surrounding context.

md

**它不会碍事：** 任何失败（家目录只读、配额满、无 HOME）都静默跳过，不报错、不改退码、不吐一句杂音。同一天跑多次只留一枚。

要清掉：`rm -rf ~/.cue-usage`。

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 28)May include surrounding context.

md

- **为什么要有它：** 平台的两个下载计数器都不可信——新 listing 上架首 48 小时会一次性播种 50~60 的初始计数，那不是用户下载。本地这枚文件是本件唯一能证明「真有人装上并跑过」的证据。
- **规矩：** `try/except` 全包，任何失败（家目录只读、配额满、无 HOME）静默跳过——不报错、不改退码、不吐杂音。同一天跑多次只留一枚（`touch` 前先判存在）。
- 清掉：`rm -rf ~/.cue-usage`。

**三、退码补一格：缺参数由 `3` 改 `2`**

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 152)May include surrounding context.

md

**它不会碍事：** 任何失败（家目录只读、配额满、无 HOME）都静默跳过，不报错、不改退码、不吐一句杂音。同一天跑多次只留一枚。

要清掉：`rm -rf ~/.cue-usage`。

---

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.en.md (reported line 140)May include surrounding context.

md

last line reports `档数=3｜不合=N｜不可判=N`; exit `0` all pass, `1` a mismatch, `3` a value-domain fault.

The tests cover the shell contract — `--help` exits 0, no argument exits 2, missing file or empty draft exits 3, `--demo` output passes its own checker, is byte-reproducible and is identical to the good fixture, an empty listing emits no shell, and the beacon lands while failing silently.

---

## 8. First-run beacon

After argument parsing succeeds and before any real work, the entry scripts drop an **empty file** at `~/.cue-usage/<slug>-<date>`.

**Why:** both platform download counters are unreliable — a new listing is seeded with 50–60 initial counts in its first 48 hours, and that is not people downloading. This local file is the only evidence this piece has that someone actually installed it and ran it.

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line o

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 152)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 152)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

Persistent skill-and-date markers under ~/.cue-usage are unrelated to generating an evidence-linked cash-flow report and are not disclosed in this document. The supplied tests corroborate this behavior, which creates a limited local privacy and filesystem side effect rather than demonstrated exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The documented workflow does not disclose persistent usage records outside the requested output location, while the supplied tests explicitly require such markers. This creates an unnecessary local record of skill usage; there is no evidence of remote transmission, and the exact argument-parsing timing alleged by the finding is not verifiable from the supplied implementation excerpts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

该代码实际执行的是 MCP 服务发现和工具枚举，而非获取财报、提取现金流披露、核对引用或执行声明中的五道检查。尽管网络访问可以作为财报分析的辅助实现细节，但所示请求针对通用工具目录与路由端点，未显示与财报来源或现金流分析的关联，因此体现了未声明的能力及不同的直接用途。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The documentation advertises self-contained reporting and validation but omits the local usage markers required by the supplied tests, including demo and self-test paths. Empty, daily-deduplicated files still reveal usage dates, although their limited contents and lack of demonstrated networking substantially reduce impact.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk performs service discovery rather than the declared cash-flow analysis, citation extraction, or validation. Network access could support report retrieval, but this code retrieves a tool catalog and enumerates remote tools, with no demonstrated connection to financial-report sources or the stated workflow. The mismatch is the unrelated resource access and discovery behavior, not merely the use of curl. No report upload, data exfiltration, or execution of discovered tools is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The supplied chunk performs generic tool-service discovery rather than retrieving financial disclosures, extracting cash-flow figures, citing evidence, or validating the prescribed report. Tool discovery could support the declared workflow, but this code provides no financial-report-specific connection establishing that role. The visible behavior is therefore materially different from the stated purpose. No financial-data exfiltration or remote tool execution is shown.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_cash_flow.py (reported line 32)May include surrounding context.

python

def run(*args, env=None, cwd=None):
    e = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
    if env:
        e.update(env)
    return subprocess.run([sys.executable, "-B", str(args[0]), *map(str, args[1:])],

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_cash_flow.py (reported line 169)May include surrounding context.

python

os.chmod(td, 0o700)

    def test_no_home_is_silent(self):
        e = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
        e.pop("HOME", None)
        r = subprocess.run([sys.executable, "-B", str(CHECK), "--demo"],
                           capture_output=True, text=True, env=e, cwd=str(PKG))

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.en.md (reported line 53)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

take the group's routing address from the catalog, then confirm the tools are present

curl -s -X POST "$ROUTING_URL"
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.en.md (reported line 52)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

take the group's routing address from the catalog, then confirm the tools are present

curl -s -X POST "$ROUTING_URL"
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 53)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

从目录里取本组的路由地址，确认工具在场

curl -s -X POST "$ROUTING_URL"
-H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Self-calculated figures can pass without the operand quotations and anchors required by the manifest.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The validator exempts self-calculated lines from quotation-and-anchor checks and accepts numerator/denominator labels with source IDs without requiring operand quotations. FCF checks are weaker still, allowing unsupported calculations to receive an all-clear result and undermining the skill's central financial-evidence guarantee.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cash_flow.py (reported line 35)May include surrounding context.

python

e = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
    if env:
        e.update(env)
    return subprocess.run([sys.executable, "-B", str(args[0]), *map(str, args[1:])],
                          capture_output=True, text=True, env=e, cwd=str(cwd or PKG))

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_cash_flow.py (reported line 171)May include surrounding context.

python

def test_no_home_is_silent(self):
        e = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
        e.pop("HOME", None)
        r = subprocess.run([sys.executable, "-B", str(CHECK), "--demo"],
                           capture_output=True, text=True, env=e, cwd=str(PKG))
        self.assertEqual(r.returncode, 0)
        self.assertEqual(r.stderr, "", f"无 HOME 不许吐杂音：{r.stderr[:200]}")

The documented first-run beacon creates persistent usage-tracking files unrelated to cash-flow analysis.

Low

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The documented behavior creates persistent, dated usage records outside the workspace without an opt-in mechanism. This is unnecessary for financial analysis and exposes local usage history, although the files are empty and no transmission is shown.

Content

No source excerpt is available for this finding.

The validator silently records usage in the user's home directory, unrelated to cash-flow validation.

Low

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

mark_first_run writes a dated usage marker into the user's home directory without an opt-in, including for demos, self-tests, and missing-path invocations. This introduces unnecessary persistence and locally observable usage history into a financial validator, though it does not transmit data.

Content

No source excerpt is available for this finding.