Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所示代码执行的是远程 MCP 服务发现和工具枚举，而非研究初稿生成或本地校验。声明未说明这类基础设施访问，也未展示其与个股研究任务的必要联系，因此不能视为普通的支持性实现细节。声明中的“零网络”直接修饰机检流程，未必禁止整个研究过程联网，但也没有涵盖此处的远程工具发现行为。
- Content
Security audit
个股深度研究·逐条挂源（Equity Research · Citation）
Security checks for vulnerabilities and agentic risk
Overview
The verdict is benign with medium confidence: scanners found the advertised research and local checking purpose alongside unexplained network requests and gaps in the note validator, while one unresolved reference leaves some evidence incomplete.
Review the network requests and decide whether they are expected in your workflow. The note checker has reported gaps in calculation and recommendation safeguards, so do not rely on it alone to validate financial content. Skillspector scanned all listed components but marked analysis partial because a local reference could not be resolved; the overall evidence is therefore incomplete.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所示代码的实际行为是远程服务与工具发现，而不是研究初稿生成或本地合规检查。即使工具发现可能作为更大流程的辅助步骤，访问外部目录和路由服务仍直接违反“零网络”的明确边界。代码未展示将目录响应解析为 ROUTING_URL 的过程，也未展示后续工具调用，因此不能据此推断更多行为。
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000
从目录里取本组的路由地址，确认工具在场
curl -s -X POST "$ROUTING_URL"
-H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000
take the group's routing address from the catalog, then confirm the tools are present
curl -s -X POST "$ROUTING_URL"
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'text
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
The self-calculation validator contradicts its documented enforcement of non-percentage ratios and explicitly marked calculations.
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
The self-calculation helper returns immediately when it finds no percentage token, so non-percentage ratio claims do not receive the documented ratio validation. Although discovery lines have a separate explicit-calculation source check, table rows do not, allowing a table calculation marked 〔自算〕 without numerator and denominator sources to pass.
- Content
The investment-recommendation redline check excludes the key-numbers table, allowing prohibited recommendations to pass validation.
Medium
- Category
- Excessive Agency
- Confidence
- 99% confidence
- Finding
The key-figure table branch validates formatting, references, and percentages but never invokes the investment-recommendation redline check. A table cell can therefore contain a prohibited rating or target price while the note still passes, undermining a central financial-content safeguard.
- Content