政府补助 · 递延收益 · 利润依赖

• Outcome: Review
• Latest audit: Nov 12, 2026 · 3:10 PM UTC
• Version: 0.2.1

Overview

ClawScan marks this skill suspicious because its documented network steps conflict with its offline promise, and the scanners also report local usage tracking and a financial-validation exception; some analysis was incomplete.

Consider the suspicious verdict and the conflict with the offline promise before installing. The scanners report network instructions, persistent local usage markers, and a ratio-validation exception; they do not establish malicious intent or sensitive-data exfiltration. Analysis was partial: 14 of 16 components were fully inspected and 2 were partially inspected, so the evidence is incomplete.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 73)May include surrounding context.

md

- **为什么要有它：** 平台的两个下载计数器都不可信——新 listing 上架首 48 小时会一次性播种 50~60 的初始计数，那不是用户下载。本地这枚文件是本件唯一能证明「真有人装上并跑过」的证据。
- **规矩：** `try/except` 全包，任何失败（家目录只读、配额满、无 HOME）静默跳过——不报错、不改退码、不吐杂音。同一天跑多次只留一枚（`touch` 前先判存在）。
- 清掉：`rm -rf ~/.cue-usage`。

**零通道骨架**（`scripts/make_outline.py`，零网络、零计费、不依赖任何通道产物）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 127)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

md

**它不会碍事：** 任何失败（家目录只读、配额满、无 HOME）都静默跳过，不报错、不改退码、不吐一句杂音。同一天跑多次只留一枚。

要清掉：`rm -rf ~/.cue-usage`。

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · CHANGELOG.md (reported line 73)May include surrounding context.

md

- **为什么要有它：** 平台的两个下载计数器都不可信——新 listing 上架首 48 小时会一次性播种 50~60 的初始计数，那不是用户下载。本地这枚文件是本件唯一能证明「真有人装上并跑过」的证据。
- **规矩：** `try/except` 全包，任何失败（家目录只读、配额满、无 HOME）静默跳过——不报错、不改退码、不吐杂音。同一天跑多次只留一枚（`touch` 前先判存在）。
- 清掉：`rm -rf ~/.cue-usage`。

**零通道骨架**（`scripts/make_outline.py`，零网络、零计费、不依赖任何通道产物）：

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.md (reported line 127)May include surrounding context.

md

**它不会碍事：** 任何失败（家目录只读、配额满、无 HOME）都静默跳过，不报错、不改退码、不吐一句杂音。同一天跑多次只留一枚。

要清掉：`rm -rf ~/.cue-usage`。

---

YARA rule 'agent_skill_destructive_autonomous_actions': Autonomous destructive filesystem, shell history, or repository actions in AI agent skills [agent_skills]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.en.md (reported line 115)May include surrounding context.

md

bad samples one by one / line-by-line substitution on the good sample as a positive-and-negative control. The last line reports `档数=3｜不合=N｜不可判=N`.

The tests cover the shell contract — `--help` exits 0, no argument exits 2, missing file exits 3, `--demo` output passes its own checker and is byte-reproducible, an empty listing emits no shell, and the beacon lands while failing silently.

---

## 8. First-run beacon

After argument parsing succeeds and before any real work, the entry scripts drop an **empty file** at `~/.cue-usage/<slug>-<date>`.

**Why:** both platform download counters are unreliable — a new listing is seeded with 50–60 initial counts in its first 48 hours, and that is not people downloading. This local file is the only evidence this piece has that someone actually installed it and ran it.

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line o

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 127)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · README.en.md (reported line 127)May include surrounding context.

md

**It never gets in the way:** any failure (read-only home, full quota, no `HOME`) is skipped silently — no error, no exit-code change, not a single line of noise. Running it several times in one day still leaves one file.

To clear it: `rm -rf ~/.cue-usage`.

---

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

External catalog retrieval and MCP tool discovery are inconsistent with the description's explicit zero-network promise. The body discloses these steps, so the issue is contradictory authorization expectations rather than wholly concealed network behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description promises zero network access, but the workflow directs external catalog retrieval and a POST to a remotely supplied routing URL. Although these operations are documented in the body, they violate the advertised offline boundary and introduce remote endpoint trust.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The prescribed HTTP requests contradict the advertised offline operation and contact an endpoint selected through remote catalog data. This creates unexpected network activity and a remote trust dependency, rather than demonstrated sensitive-data exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied outline code confirms undisclosed daily usage markers, while the fixture suite expects acceptance of explicitly marked self-calculation despite the disclosed-values-only contract. This introduces an unnecessary persistent side effect and weakens financial-output integrity, although the checker implementation itself was not supplied for verification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied outline implementation creates an undisclosed usage marker outside the requested input and output paths. However, producing an incomplete outline is explicitly documented as the fallback workflow, and the outline generator is not supposed to implement the separate checker's five checks; those portions of the finding are false positives.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The zero-network claim conflicts with instructions to retrieve a remote MCP catalog and discover tools at its routing endpoint. Following these instructions would cross an expected offline boundary, though the shown requests do not transmit ledger contents or credentials.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied implementation and tests establish persistent, skill-specific daily usage markers with silent failure handling. These markers reveal local usage dates without user-facing disclosure, but there is no evidence that they transmit data or provide executable persistence.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 三档离线自检，零网络零计费

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · tests/test_gov_grant.py (reported line 32)May include surrounding context.

python

def run(*args, env=None, cwd=None):
    e = dict(os.environ, PYTHONDONTWRITEBYTECODE="1")
    if env:
        e.update(env)
    return subprocess.run([sys.executable, "-B", str(args[0]), *map(str, args[1:])],

The documented channel-verification workflow makes external requests despite the manifest's zero-network claim.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The optional verification instructions make external requests despite the supplied zero-network commitment and the README's statement that the skill issues no requests. An agent following them could cross an expected offline boundary, exposing connection metadata, although the displayed payload contains no documents or credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.en.md (reported line 149)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

take the group's routing address from the catalog, then confirm the tools are present

curl -s -X POST "$ROUTING_URL"
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.en.md (reported line 95)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

take the group's routing address from the catalog, then confirm the tools are present

curl -s -X POST "$ROUTING_URL"
-H "Content-Type: application/json"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

The documented setup workflow makes external requests despite the manifest's zero-network commitment.

Medium

• Category: Excessive Agency
• Confidence: 98% confidence

Finding

The documented setup makes catalog and routing requests despite the supplied zero-network commitment and the README's assertion that the skill sends no requests. Although labeled optional, these instructions can cause an agent to breach a user's expected offline boundary; no sensitive payload is shown.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 149)May include surrounding context.

CATALOG="https://cuecue.cn/api/mcp-catalog" curl -s "$CATALOG" | head -c 2000

从目录里取本组的路由地址，确认工具在场

curl -s -X POST "$ROUTING_URL"
-H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

The prescribed disclosure-retrieval workflow makes network requests despite the manifest's explicit zero-network promise.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The skill prescribes catalog discovery and a follow-up network POST despite the supplied zero-network commitment. This can induce an agent to make unauthorized outbound connections in an offline financial-document workflow, even though the displayed discovery payload contains no financial data.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The manifest promises zero network use, but the prescribed data-acquisition workflow makes external HTTP requests.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The acquisition commands make external HTTP requests despite the manifest's zero-network promise. Users selecting this skill for offline processing could therefore experience unauthorized outbound connections; no sensitive request payload is shown.

Content

No source excerpt is available for this finding.