Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because scanners report external MCP service discovery and privacy concerns that are not clearly connected to its stated financial documentation purpose; some analysis was incomplete.
Consider the reported external processing and MCP requests before installing, especially if you may provide private report links, access tokens, or local paths. The scan is partial: 13 of 14 components were fully inspected, and one shell script could not be completely analyzed, so the evidence does not establish that the skill is safe.
所给代码仅执行远程 MCP 服务发现和工具列表查询，没有提取、登记或核验存货、应收账款、合同资产数据，也没有处理原文锚点和自算指标来源。MCP 查询可能是某项任务的辅助步骤，但本代码未提供其与声明用途相关的证据，因此所展示行为与声明用途存在实质偏离。代码注释所称的握手及确认三个工具也未由实际命令完成：命令仅调用 tools/list，未验证工具数量。
所提供代码仅执行网络目录访问与工具发现，未体现存货、应收账款、合同资产、账龄或准备计提信息的提取、登记及引用校验，也未说明这些MCP服务如何支持声明任务。因此，就该代码块而言，实际功能与声明用途存在实质偏离。工具发现本可属于辅助实现细节，但此处没有可见的任务关联。此外，代码注释声称完成握手并确认三个工具存在，实际仅发送tools/list请求，没有握手流程或工具数量校验。
The supplied chunk performs remote service discovery and tool enumeration rather than the declared working-capital documentation. Although discovering tools can be a supporting implementation detail, nothing in this chunk connects the catalog or MCP endpoint to financial disclosures, source anchoring, or the specified accounting analysis. The mismatch is limited to the supplied behavior; the code does not demonstrate financial-data exfiltration or execution of the enumerated tools.
The supplied chunk performs service discovery and tool enumeration, not financial-data extraction, evidence anchoring, or working-capital analysis. Although MCP discovery could support the declared task, this chunk does not establish that the catalog or tools provide relevant financial information. Its observable purpose therefore differs from the description. The code does not show tool execution, financial-data transmission, or exfiltration.
Referenced artifact was not completely inspected
bash scripts/fixtures/run_fixtures.sh # 离线样例三档（零网络零计费）
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://cuecue.cn/api/mcp-catalog | head -c 500
curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://cuecue.cn/api/mcp-catalog | head -c 500
curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://cuecue.cn/api/mcp-catalog | head -c 500
curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -s https://cuecue.cn/api/mcp-catalog | head -c 500
curl -s -X POST "$MCP_ENDPOINT" -H 'Content-Type: application/json'
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'
The workflow directs the agent to submit report URLs or local paths to an external parser without checking sensitivity or obtaining informed approval. Public filings reduce the usual exposure, but private report links, URL tokens, and local-path metadata could be disclosed; the supplied text does not establish that file contents are uploaded.
The instructions send user-provided report URLs or local paths to an external MCP parser without a sensitivity check or privacy notice. Although A-share filings are generally public, private URLs, embedded access tokens, and local-path metadata can still cross that boundary without informed approval.
The skill instructs the agent to give an external parser user-supplied URLs or local paths without first establishing permission for external disclosure. The public-filing context limits typical sensitivity, but private links, access tokens, and filesystem metadata remain exposed; actual file-content upload is not demonstrated.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow directs user-provided report URLs or local paths to an external parser without checking whether external sharing is authorized. Most published filings are low sensitivity, but private links, URL access tokens, or local-path metadata could be disclosed; the source does not prove that local file contents are uploaded.
L020 promises to identify every unavailable item, and L041–L042 explicitly state that skeleton gaps are enumerated in the final section. Instead, L097–L098 unconditionally emit “共 0 项·未取到 0 项” and “未取到 0 项：无”, while L103 leaves every financial item awaiting evidence; the outline-input mode repeats this contradiction at L141–L142. Although the output is clearly labeled unfinished, its missing-evidence register contradicts the documented behavior and obscures the outstanding evidence gaps.