晨会纪要·数据槽与覆盖率（盘前早报）

• Outcome: Review
• Latest audit: Nov 13, 2026 · 9:19 PM UTC
• Version: 0.1.3

Overview

ClawScan marks this skill suspicious because it reports behavior beyond the stated morning-briefing purpose and an output-handling concern; its scan was partial, so the evidence is incomplete.

Consider the reported mismatch, external handling of URLs or paths, and provenance-check weakness before installing. The scan covered 12 of 13 components fully, with one partially inspected, so it does not establish that the skill is safe; the verdict is suspicious, not a claim that its author acted maliciously.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk performs service and tool discovery rather than the declared financial briefing task. Tool discovery could support such a workflow, but this code establishes no connection to financial sources or briefing generation. It neither extracts nor assigns an endpoint from the catalog; MCP_ENDPOINT must already be supplied externally. The observable behavior therefore materially differs from the declared purpose. No execution of discovered tools is shown.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

The supplied chunk performs service discovery rather than collecting the specified financial information or producing and validating the declared briefing. Tool discovery could support such a workflow, but this chunk establishes no connection between the external catalog or configured MCP endpoint and the required data sources. It also does not automatically derive MCP_ENDPOINT from the catalog response. The visible behavior is therefore materially different from the declared purpose. No tool execution beyond enumeration, financial analysis, or data exfiltration is demonstrated.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

该片段实际用于MCP服务发现与工具枚举，没有展示金融数据检索、八槽整理、来源与日期标注或缺口核对。工具发现可以是实现细节，但此处未体现这些服务与声明用途的关联，因此所展示行为与声明用途存在实质偏差。代码仅查询工具清单，没有证据表明它执行了远程工具、泄露本地数据或提供投资建议。

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 155)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 离线样例三档（零网络零计费）

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.en.md (reported line 48)May include surrounding context.

curl -s https://cuecue.cn/api/mcp-catalog | head -c 500

2) MCP handshake, confirm the tools are present

curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

curl -s https://cuecue.cn/api/mcp-catalog | head -c 500

2) 按 MCP 协议握手，确认工具在场

curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.en.md (reported line 123)May include surrounding context.

curl -s https://cuecue.cn/api/mcp-catalog | head -c 500

2) MCP handshake, confirm the tools are present

curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 125)May include surrounding context.

curl -s https://cuecue.cn/api/mcp-catalog | head -c 500

2) 按 MCP 协议握手，确认工具在场

curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'

text

The channel workflow directs full-text announcement retrieval and attachment parsing despite the skill's title-only scope.

Medium

• Category: Excessive Agency
• Confidence: 92% confidence

Finding

The manifest limits the announcement slot to overnight announcement titles, and L035–L036 and L141 explicitly reserve full-text announcement reading for another skill. However, L116–L128 instruct the agent to fetch originals and attachment text, submit announcement URLs or local paths for processing, and read the resulting bodies and tables. This prescribed workflow exceeds the stated title-only purpose.

Content

No source excerpt is available for this finding.

The workflow sends announcement URLs or local file paths to an external channel without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The workflow directs the agent to send user-supplied URLs or local paths to an external channel without distinguishing public references from private inputs or obtaining transfer approval. Local paths can expose identifying filesystem details, and private or signed URLs can reveal confidential locations or grant document access; public-announcement use reduces but does not eliminate this risk.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow sends document URLs or local file paths to an external service without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 92% confidence

Finding

The channel instructions explicitly forward announcement URLs or local paths without a privacy check or transfer-specific consent. Even if most announcements are public, user-supplied paths can disclose internal filesystem details and signed or private URLs can expose confidential documents; the source does not prove that local file contents are uploaded.

Content

No source excerpt is available for this finding.

The anchor checker exempts an entire line containing [待人工], contradicting the documented clause-only exemption.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The anchor validator skips an entire bullet whenever it finds [待人工] anywhere on the line, allowing a separate factual clause to omit both its source and retrieval date without triggering MB-ANCHOR. This bypass undermines the briefing's provenance gate, although it does not disable the separate clause-based red-line checks or filled-slot validation.

Content

No source excerpt is available for this finding.