cue-dd-checklist

• Outcome: Review
• Latest audit: Oct 22, 2026 · 8:17 PM UTC
• Version: 0.1.30

Overview

This research skill needs review because its connection paths can expose an API key to an unapproved destination, and its company-matching check is weaker than advertised.

Prefer user-supplied-document mode without an API key until credential handling is corrected. Avoid the raw curl examples; authenticated requests should validate destinations and reject unsafe redirects. Review fixed installation versions, and manually verify company names, codes, and source documents before relying on a report.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (31)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 58)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 62)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with one of the ids listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 63)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Service discovery and tools/list are legitimate prerequisites for the disclosed research workflow, so the claimed purpose mismatch is not substantiated. However, section 8 directs authenticated connections using domain routing without establishing destination-validation requirements in the supplied file; if routing metadata is attacker-controlled, forwarding the bearer credential could disclose it to an unauthorized endpoint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

This duplicates the credential-routing concern in the other TP4 finding rather than establishing another independent vulnerability. Optional CUE_API_KEY use is consistent with the skill's purpose, but the supplied instructions do not visibly constrain which routed endpoint may receive the bearer credential; actual exploitability depends on routing trust and safeguards in the referenced components.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

> 契约权威=本包 `CONTRACT.md`（内部契约的对外派生镜像）；验收题单由外部评审工作区维护、不随本包发布——本包**自带成品样与 runner，复现性以 `scripts/fixtures/run_fixtures.sh` 为准**（逐题 1:1、题数与真码集由外部对账表维护、不随本包发布）。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md

必过、41 必拦，CJK 与中英混排各测）。**控制样的族名与枚数不写进本文**——题单以行内代码点名它出过的控制，生成器据此核「点名即在盘」，实际枚数由 `run_fixtures.sh` 现跑报出（活计数只有一处权威来源：枚数不进本文，避免文档与夹具两处各说一套）。

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh # 全量；退出码非 0=有不符

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 189)May include surrounding context.

md

bash scripts/fixtures/run_fixtures.sh bad-B14 # 单样

Automatic redirects bypass the documented credential-destination checks.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The destination guard checks only the initial URL, while urllib.request.urlopen follows supported redirects without applying that guard again. For POST redirects such as 302 or 303, Python's default redirect handler can copy the Authorization header onto the redirected GET, exposing CUE_API_KEY to an unauthorized host or an HTTP destination if an initially authorized endpoint supplies such a redirect. This violates the script's explicit credential-egress guarantee, although exploitation requires control over or influence on a redirect from an allowed endpoint.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · scripts/fixtures/run_fixtures.sh (reported line 29)May include surrounding context.

sh

# 本 runner 绝不删那里任何不是我建的东西（`DD_OUTER_TMP` 只为那条判据与注入反证可见）。
DD_OUTER_TMP="${TMPDIR:-/tmp}"; export DD_OUTER_TMP
RUNTMP="$WORK/tmp"
mkdir -p "$RUNTMP" || { echo "FAIL 建不起 runner 私有临时根 $RUNTMP（环境故障，不续跑不假绿）"; rm -rf "$WORK"; exit 1; }
export TMPDIR="$RUNTMP"
if ls -A "$DD_OUTER_TMP" >/dev/null 2>&1; then
  tmp_before="$(cd "$DD_OUTER_TMP" && ls -A | sort)"; tmp_snap_ok=1

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 88% confidence

Finding

The documented installation command uses npx skills without a version, potentially downloading and executing a changing npm package with the user's permissions. A compromised package release could execute malicious code, and the referenced skill repository is also not pinned to an immutable revision. This is a conditional supply-chain risk rather than an MCP-server configuration issue; its appearance in a historical changelog reduces immediate exposure because the text does not itself execute anything.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command invokes an unpinned npm executable through npx skills and installs skill content from a mutable repository reference. Although this is ordinary setup guidance rather than evidence of malicious intent, a compromised future release or repository update could introduce code or agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The collection-wide installation command uses an unpinned npm CLI and a mutable external skill repository. Selecting from a collection does not establish integrity, and compromised upstream content could execute during installation or influence subsequent agent behavior.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The individual cue-data-mcp installation example also leaves both the CLI version and source revision unpinned. Limiting installation to one skill reduces scope but does not prevent a changed or compromised upstream dependency from supplying executable code or adversarial agent instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The inline shell example sends CUE_API_KEY to a URL taken directly from the catalog response, checking only that it is nonempty. A compromised catalog or routing entry could direct the bearer token to an attacker-controlled host or an unencrypted HTTP endpoint; the HTTPS and authorized-host checks described for the separate helper script do not protect this shell example.

Content

Scanner excerpt · README.en.md (reported line 67)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses an unversioned npm CLI and an unpinned skill repository, allowing downloaded executable code and agent instructions to change between installations. Although the detector incorrectly describes the CLI as an MCP server, the underlying supply-chain exposure is real: a compromised upstream release could execute with the installing user's privileges or introduce malicious skill instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The collection installation command resolves both the skills CLI and repository content without immutable version constraints. Installing data-access skills makes upstream compromise consequential because the resulting agent instructions may influence workflows that use API credentials; the statement that these are official skills does not ensure artifact integrity.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The single-skill installation command narrows which skill is installed but still leaves the CLI version and repository revision unpinned. A compromised or unexpectedly changed upstream artifact could therefore introduce executable code or malicious instructions into the agent's credential-bearing data-access workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

Bearer authentication to the intended service is legitimate, but this shell example sends CUE_API_KEY to a URL taken directly from remote catalog data without checking its scheme or host. A compromised or malicious catalog response could direct the credential to an attacker-controlled endpoint or an unencrypted HTTP endpoint; the separately described helper's destination checks do not protect this raw curl command.

Content

Scanner excerpt · README.md (reported line 68)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The documented npx skills add command invokes an unpinned package and installs skill content from a repository without specifying an immutable revision. A compromised or unexpectedly changed upstream release could therefore introduce executable code or adversarial agent instructions; this is an installation supply-chain issue, not specifically an unpinned MCP server.

Content

No source excerpt is available for this finding.

L0805–L0812 bypass the documented full-name-plus-code attribution requirement for code-only subjects.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

For code-only subjects, the initial ok expression accepts the subject code appearing anywhere in the matching evidence bodies, so execution skips the subsequent full-name-plus-code validation. An evidence snapshot containing only the code, or an unrelated record mentioning it, can therefore satisfy attribution without the required dual identifier on the anchored record. In a financial due-diligence checklist, this weakens report integrity and can admit incorrectly attributed risk facts, although it does not enable code execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.