竞品决策简报·逐条带出处

• Outcome: Review
• Latest audit: Oct 22, 2026 · 8:24 PM UTC
• Version: 0.3.31

Overview

The research workflow is coherent, but its optional connection checks can expose your API key through incomplete destination safeguards.

Use the briefing workflow without the optional Cue connection until credential-bearing commands enforce approved HTTPS destinations and block unsafe redirects. Review dependency versions before installing, approve document uploads and costs separately, and verify unsupported comparisons before relying on a brief.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (28)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 53)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 57)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/cue-onboarding.md (reported line 40)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · references/cue-onboarding.md (reported line 44)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk is an MCP discovery and connectivity workflow, not an evidence-based competitive-brief workflow. It neither processes a subject and competitors nor builds evidence tables, validates claims, or produces the declared report. External tools could support research, but no such research connection is present here; the code instead discovers remote services and sends a credential to a dynamically selected endpoint, capabilities not represented in the declared purpose. The placeholder domain ID requires configuration before the final request can succeed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code's primary function is MCP endpoint discovery and authenticated tool listing, rather than competitive research or evidence-backed report generation. Although tool discovery could support a broader research workflow, this chunk establishes no connection between the selected service and the declared briefing task. The external catalog access and credential-bearing request are not represented in the description. As supplied, DOMAIN_ID is a placeholder that must be replaced before the final request can succeed.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code's primary purpose is service discovery and connectivity testing, materially different from the declared evidence-based competitive briefing workflow. It contains no implementation of evidence tables, competitor comparisons, claim classification, recommendations, or coverage statistics. Its external catalog access and optional credential-bearing requests are not disclosed in the description. Explicit --post opt-in and HTTPS/host checks limit the authenticated request behavior but do not resolve this purpose mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied chunk performs MCP onboarding and connectivity discovery rather than evidence collection, comparison, or brief generation. Tool discovery can support a research workflow, but this chunk establishes a third-party integration and sends a credential to a catalog-selected URL without a stated connection to the declared briefing workflow. This is a material undeclared behavior, not merely formatting or evidence-table implementation. The code does not show research-data exfiltration or malicious intent; the observable concern is the undisclosed integration and credential transmission.

Content

No source excerpt is available for this finding.

Automatic redirects bypass the documented HTTPS and authorized-host checks for credential transmission.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The initial URL passes the guard, but urllib's default redirect handling can follow POST responses such as HTTP 301, 302, or 303 to another host while retaining the Authorization header, even when converting the request to GET. An attacker controlling a redirect on an allowed endpoint could therefore obtain CUE_API_KEY through an unapproved destination or an HTTP downgrade; the skill's explicit credential-protection assurances make this bypass particularly consequential.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The inline shell example sends CUE_API_KEY to a routing URL taken from a remote catalog, checking only that the value is nonempty. A compromised or misconfigured catalog could therefore direct the bearer credential to an attacker-controlled host or an unencrypted HTTP endpoint. The README describes HTTPS and host validation in a separate helper script, but those protections are absent from this inline command.

Content

Scanner excerpt · README.en.md (reported line 62)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "no value: ROUTING_URL is empty - list the ids first, then set DOMAIN_ID to one of them" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

The workflow routes user-provided documents through Cue parsing tools without a privacy warning about third-party processing.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

The workflow directs user-provided documents into Cue parsing tools without explaining whether document contents leave the local environment or requiring informed consent for third-party processing. In a competitive-analysis or investment workflow, supplied documents may contain confidential business information; explicitly selecting files does not necessarily authorize disclosure to an external provider. The actual transmission and retention behavior cannot be verified from this README alone.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The shell example sends CUE_API_KEY to a routing URL taken from a remote catalog without validating its scheme or hostname. A compromised or incorrectly configured catalog could direct the request to an attacker-controlled endpoint or an unencrypted HTTP endpoint, exposing the credential. Authentication is legitimate for this connectivity check, but the safeguards described for the separate Python helper are absent from this shell example.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The fallback instructions allow unsupported model knowledge to be recorded as inference rather than opinion.

Medium

• Category: Excessive Agency
• Confidence: 91% confidence

Finding

The fallback permits unsupported cached or training-derived claims to enter the evidence table as inference, despite defining inference as a deduction from multiple facts and opinion as lacking a citable source. Because the brief is rendered from that table, a tool outage can weaken the central evidence-integrity guarantee and allow unsupported claims to influence recommendations; explicit provenance labels reduce, but do not eliminate, this risk.

Content

No source excerpt is available for this finding.

The example brief does not provide the per-cell evidence mapping required by the manifest.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The manifest requires every comparison-table cell to correspond to an evidence-table cell. This table supplies conclusions about price, context, openness, and maturity without evidence-cell identifiers or links; the document-level evidence-table reference and later product-level source URLs do not establish that mapping. Consequently, readers cannot audit individual comparisons using the traceability mechanism the skill promises.

Content

No source excerpt is available for this finding.

The evidence table uses an explicitly speculative estimate as evidence despite the manifest's prohibition on guesses as sources.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The Cursor context-window row introduces a speculative 15K–50K estimate attributed only to unspecified community discussion, contrary to the skill's explicit prohibition on guesses as sources. Labeling it as an inference in the evidence table could allow an unsupported estimate to influence the competitive brief and migration decision; the low-confidence label reduces, but does not eliminate, this evidence-integrity risk. This is a reliability weakness in a decision-support workflow, not evidence of prompt injection or code execution.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting a named skill limits the installation scope but does not pin either the npx installer or the downloaded skill revision. A compromised upstream release could therefore change executable installer behavior or the instructions subsequently trusted by the agent.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The collection-installation command uses an unpinned npx executable and a repository without an immutable revision. This is the same supply-chain weakness as the other installation commands on this line, not evidence of a separate malicious MCP server.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command invokes an unpinned skills package through npx and installs skill content from a mutable repository reference. Although this is not itself an MCP server declaration, compromised future package or repository updates could execute installer code or introduce adversarial agent instructions; checking that the skill appears installed does not establish integrity.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example sends CUE_API_KEY to a URL taken directly from remote catalog data without enforcing HTTPS or an authorized hostname. Authentication to the intended service is legitimate, but a compromised or misconfigured catalog could redirect the credential to an attacker or an HTTP endpoint; the prose describing checks in the separate Python helper does not protect this shell command.

Content

Scanner excerpt · references/cue-onboarding.md (reported line 49)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Static analysis

No suspicious patterns detected.