A股财报深度点评

• Outcome: Review
• Latest audit: Oct 22, 2026 · 8:02 PM UTC
• Version: 0.3.42

Overview

The financial-report workflow fits its purpose, but its optional connection checks can expose your API key to unintended destinations.

Use the documented workflow without Cue credentials until authenticated requests validate their destinations and safely handle redirects. Avoid the README's authenticated curl examples meanwhile. Submit only public documents to external parsing, approve charges and directory grants deliberately, and review installer versions and report evidence before use. These credential-handling defects warrant Review; the artifacts do not establish malicious intent.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 55)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 59)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code has a materially different primary purpose: service connectivity diagnostics. It contains no financial-report drafting or implementation of the four declared checks. Its remote catalog access and credential-bearing requests are not disclosed in the description. The authenticated POST requires explicit --post and passes an initial HTTPS/host-suffix guard, but those safeguards do not resolve the description–behavior mismatch. Without --post, the script still fetches the catalog unless a local snapshot is supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied shell snippet performs MCP endpoint discovery and authenticated tool enumeration, not financial analysis, draft generation, or the declared validation checks. These network operations and credential use are not connected to the declared workflow in the supplied code, so they represent a materially different capability rather than an established supporting implementation detail. The snippet does not demonstrate misuse of the API key, but its transmission to the resolved endpoint is explicit.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

该代码的实际功能是外部 MCP 服务发现、认证访问和工具枚举，没有展示财报初稿生成或四道机检。声明也未说明其依赖该目录、远程工具服务或 API 凭据，因此这不是已明确对应所述流程的普通实现细节，而是存在实质性功能与资源访问不匹配。代码只请求工具列表，未显示调用具体工具、上传财务材料或执行其他远程操作。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code supports the declared financial-note workflow, and its source validation matches the stated limits. However, the description explicitly presents the actual scope of four machine checks, while main() additionally invokes check_scaffold() and substantially broader ledger checks that can independently fail delivery. The list-line exemption is also conditional in code rather than the general exemption described. These are observable differences in acceptance criteria, not merely internal implementation details. The absence of draft generation in this validator chunk is not itself treated as a mismatch.

Content

No source excerpt is available for this finding.

The credential-destination guarantee is bypassed by automatic HTTP redirects.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The destination guard validates only the initial URL, while urllib.request.urlopen automatically follows supported redirects and can copy the Authorization header to a different host or an HTTP destination. If an initially authorized endpoint is compromised or exposes an attacker-controlled redirect, running --post can disclose CUE_API_KEY despite the stated HTTPS and authorized-host guarantees.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documented installation command uses npx skills without pinning the npm package version or the source repository revision. Although this is a skill installer rather than an MCP server, following the command can execute mutable third-party code with the user's permissions; compromise of the package or repository could expose local files and credentials. Its placement in a historical changelog reduces immediate exposure but does not make the copyable command reproducible or trustworthy.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The npx skills add sensedeal/cue-skills installation guidance leaves both the executable installer version and the installed repository revision unspecified. This is a supply-chain exposure, not specifically an unversioned MCP server: a compromised upstream release could execute malicious installer code or distribute adversarial skill instructions. The optional onboarding context limits automatic exposure, while the whole-collection installation option broadens the content trusted if users follow it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command runs an unpinned npm CLI and retrieves skill content from an unpinned repository revision. Although this is a skill installer rather than an MCP server, a compromised or unexpectedly changed release could execute installer code or introduce malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The collection-install command leaves both the npm CLI version and the external skill collection revision unpinned. Installing multiple optional skills broadens the amount of mutable third-party code and agent instructions trusted by the workflow; the MCP-server label is inaccurate, but the supply-chain concern is valid.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting an individual skill limits installation scope but does not pin either the executing npm package or the downloaded skill revision. A compromised upstream update could therefore change executable installer behavior or the instructions subsequently followed by the agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example attaches CUE_API_KEY to a URL taken directly from a catalog response without validating its scheme or authorized host. A compromised catalog could direct the credential to an attacker-controlled HTTPS endpoint or an unencrypted HTTP endpoint; the gates described for the separate Python helper do not protect this shell command.

Content

Scanner excerpt · README.en.md (reported line 64)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command runs an unpinned skills package through npx and selects skill content from a repository without an immutable revision. Although this is an installer rather than an MCP server declaration, compromised future package or repository updates could introduce executable code or adversarial agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The collection installation command leaves both the npx installer version and repository revision unpinned. Installing multiple optional skills increases the amount of externally controlled content trusted by the agent, although installation is explicitly user-directed rather than covert.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Selecting one named skill limits installation scope but does not pin the npx package or the source repository revision. A compromised update to either source could therefore change the code or agent instructions installed by this command.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example sends the API key to a URL taken directly from a remote catalog, checking only that the URL is nonempty. If the catalog is compromised or returns an unsafe destination, the key can be sent to an attacker-controlled host or over plaintext HTTP; the destination checks described for the separate Python helper do not protect this curl example.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The parsing workflow sends user-supplied materials to Cue's omni-reader service without explicitly warning about third-party data transfer.

Medium

• Category: Output Handling
• Confidence: 88% confidence

Finding

The parsing workflow routes user-provided PDFs, notes, and links through a third-party service without explicitly requiring informed consent for disclosure of their contents. Naming omni-reader and requiring billing confirmation or local Bridge authorization do not clearly establish upload consent; the public-source-only rule reduces exposure but does not reliably catch confidential annotations, personal data, or accidentally supplied private files.

Content

No source excerpt is available for this finding.

Local-document parsing is instructed without disclosing third-party processing of document contents.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The workflow directs local documents into the omni parsing channel through Bridge without explicitly explaining whether their contents are transmitted to and processed by an external service. Directory-access approval and billing confirmation do not establish informed approval for that disclosure, especially because files inside an already permitted directory need no renewed access confirmation. Public financial reports reduce typical sensitivity, but user-supplied notes and other local documents may contain confidential information; the referenced reader contract was not provided to verify additional safeguards.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation instructions invoke an unpinned npm executable through npx skills and fetch skill content without an immutable revision. A compromised or malicious upstream update could execute installer code or introduce adversarial agent instructions. This is an installation supply-chain risk, not specifically an unversioned MCP server; its placement in user-facing onboarding reduces immediate exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The onboarding commands also install this skill through an unpinned executable and mutable repository reference. Future upstream changes could therefore deliver code or instructions different from those reviewed here. The command is documented rather than automatically executed, which limits immediate risk but does not remove the installation vulnerability.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.