中文多源研究速览·逐条挂源

• Outcome: Review
• Latest audit: Nov 2, 2026 · 9:28 PM UTC
• Version: 0.1.6

Overview

The drafting tools fit their purpose, but the optional connection instructions send an API key to an address without checking its destination.

Before enabling the optional connection, verify the exact destination independently and require HTTPS before supplying a limited-scope API key. The bundled local tools can operate without that key. Prefer installing the reviewed directory or an immutable revision, and manually check section order and source anchors because PASS can miss these errors. Separate auxiliary skills, the external installer, and live services were not assessed.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 32)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 36)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 36)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied shell snippet implements remote service discovery and authenticated tool enumeration. It neither drafts the declared research brief nor performs the described checks. Although research gathering could involve networking, this snippet does not retrieve research sources; its catalog access, dynamic endpoint selection, and credential-bearing MCP request constitute materially different, undeclared behavior. The selected domain must be filled in before the final request can succeed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

该代码未实现多源材料整理、四节速览生成或 check_brief.py 检查，而是执行 MCP 服务发现和带认证的工具枚举。这不是所声明研究速览功能中可直接辨认的辅助实现，且引入了未说明的远程服务与凭证使用。描述中的“零网络”明确修饰检查器，不应据此认定所有研究取材都禁止联网；但这不影响上述主要用途和能力不匹配的结论。

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 离线三档一次跑完，末行自报档数与不合枚数

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 80% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · CHANGELOG.md (reported line 30)May include surrounding context.

md

- 号序与槽位：0.1.3 → 0.1.4（配置指路补齐＝patch，非能力面变更）。本包单槽——现扫非留痕面只有技能面载版本位（`SKILL.md:7`）。

### 0.1.3 — 2026-10-29（中英并读校正：英文面那句解析腿已连判据仍把两条路压成三枚名列，与中文面的按路分写正面矛盾；非能力面变更）
- 改因：第十二批复判落下一枚 major（结论行「本批不签 LGTM；blocker 0／major 1／minor 0」，判定窗 HEAD b94df806…。英文说明面 `README.en.md:48`（改前行长 1158、病灶起列 669）写的是「宿主里那条 `tools/list` 握手，返回里含 `parse`、`get_parse_status`、`read_result` 就算连上」；产品权威 `cue-skills/cue-omni-reader/SKILL.md:76` 明写 remote-only 只暴露 `parse`／`get_parse_status`／`cancel_parse` 三支、`read_result` 只在 Bridge 那一面 ⇒ 只走 URL 的英文读者即使把那条路连对了，也永远判不成「已连」。同包中文面 `README.md:48`（行长 852）上一轮已按路分写（remote-only 在列 304、Bridge 在列 368）＝同一件事两种说法，中英正面矛盾。
- 改法（只改这半句，同句前半的数据腿一字未动）：换成与中文面同语义的按路分写——连上之后那份返回里应当能看到这些名字：remote-only 三枚（含 `cancel_parse`）、Bridge 再加四枚共七枚，拿一个固定数判两路必错一边；再把端到端写成两路各自可执行（the URL route is verified by one real URL parse, the Bridge route by one real local-file parse, remote-only cannot read local files），本包不自证也不代跑。前半那句「匿名只算目录可达、带 key 实连且结果里工具非空才算被接受、只按形状认不列工具名也不承诺枚数」原样留着——那本来就是对的形状。
- 现测（先证靶在场，再改，再复跑）：改前扫本包＝面 1∥

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command executes an unpinned npm CLI and installs skill content from a mutable repository reference. Although this is an installer rather than an MCP server, compromised or unexpected upstream updates could execute code or introduce adversarial agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Authenticated discovery is a documented part of the optional workflow, but the command sends the API key to a catalog-supplied URL without validating its scheme or destination. A compromised catalog or routing entry could redirect that credential to an attacker-controlled endpoint or an unencrypted HTTP connection.

Content

Scanner excerpt · README.en.md (reported line 41)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "no value: ROUTING_URL is empty - list the ids first, then set DOMAIN_ID to one of them" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command executes an unpinned npm CLI and obtains skill content without an immutable repository revision. This creates a supply-chain exposure during installation: an upstream compromise could run code or install malicious agent instructions, despite the skill's otherwise limited research purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The command attaches the API credential to a URL taken verbatim from the remote catalog, checking only that the value is nonempty. If the catalog or a routing entry is compromised, the key can be sent to an unauthorized host or over HTTP; keeping the key out of chat does not prevent this disclosure.

Content

Scanner excerpt · README.md (reported line 41)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The documented section-order check never validates the sections' actual order in the document.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The checker appends section entries in numeric order and then compares those same numbers with their sorted order, so the order check cannot fail. Reordered headings also produce incorrect section boundaries, allowing some malformed briefs to pass while content escapes its intended validation lane; this undermines a documented integrity gate, though it does not establish factual correctness or authorize publication.

Content

No source excerpt is available for this finding.