Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所给代码未读取员工持股计划文件，也未执行八项条款提取、原文定位或缺失信息标注。其实际功能是访问外部目录和认证后的 MCP 工具列表。片段中没有证据表明这些网络操作用于获取或处理员工持股计划资料，因此不能视为已声明用途的配套实现细节。这里的判断仅针对提供的代码片段，不推断其余未提供内容。
- Content
Security audit
员工持股条款速读
Security checks for vulnerabilities and agentic risk
Overview
ClawScan marks this skill suspicious with medium confidence because scanners flagged unpinned installation commands, external document-processing disclosure gaps, and behavior that may not match the stated purpose.
Consider the unpinned installation source and the lack of clear disclosure before sending attachments to an external parser. Avoid submitting confidential or unpublished documents unless you have checked where they go and how they are handled. Skillspector's analysis is partial because it could not resolve one referenced path, so the evidence is incomplete; the separate AIG scan completed without findings.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (17)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所提供代码用于MCP目录访问和认证端点探测，没有读取员工持股计划文件、提取八项条款、输出原句与锚点或标注缺失信息的逻辑。其主要行为与声明的文档条款速读用途明显不同，也未显示这些网络操作是实现该用途所必需的辅助步骤。
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 1. drop the skill into your skills directory mkdir -p ~/.workbuddy/skills cp -r employee-stock-ownership-cn ~/.workbuddy/skills/ # 2. ask the agent for the five-section card defined in SKILL.md, save it as my-esop-card.md
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash # 1. 放到技能目录 mkdir -p ~/.workbuddy/skills cp -r employee-stock-ownership-cn ~/.workbuddy/skills/ # 2. 让 agent 按 SKILL.md 的条款卡五段出卡，产物存成我的员工持股条款卡.md
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The installation command executes an unpinned npm CLI and retrieves skill content without an immutable source revision. This is a supply-chain weakness rather than specifically an unversioned MCP server: compromised or unexpectedly changed dependencies could execute code or install adversarial agent instructions.
- Content
The optional Cue attachment-parsing workflow lacks a warning about third-party disclosure of document content.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The optional parsing workflow does not clearly disclose that document content may be processed by an external provider. Although many filings are public, the skill also accepts user-supplied drafts that may contain confidential information, and the later no-persistence statement does not establish the provider's retention practices.
- Content
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The optional collection installer runs an unpinned npm CLI and selects skills from a mutable repository. Interactive selection limits which skills are installed but does not protect against compromised CLI code or changes to the selected skills.
- Content
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
Selecting one named skill reduces installation scope but leaves both the npm CLI and repository revision unpinned. A compromised upstream release could therefore execute with the installer's permissions or introduce malicious agent instructions.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2) take routing.url and transport for the domain from the response; never hard-code the host
3) with the key, send tools/list - proves that endpoint accepted the key, nothing else
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400text
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死
3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400text
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The installation command executes an unpinned npm CLI and installs skill content without an immutable repository revision. Although the static label calls this an MCP version issue, the actual weakness is mutable installation dependencies that could deliver executable code or adversarial skill instructions.
- Content
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The collection installation command leaves the executing CLI and skill repository revision unpinned. Choosing skills interactively does not prevent a compromised upstream release from executing code or installing malicious instructions.
- Content
MCP server referenced without pinned version: 'npx skills'.
Medium
- Category
- MCP Rug Pull
- Confidence
- 96% confidence
- Finding
The single-skill command narrows scope but still runs an unpinned npm package and retrieves a mutable skill revision. Upstream compromise could affect the local environment or subsequent agent behavior.
- Content
The attachment-parsing recovery step lacks a warning about third-party document processing.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The recovery instruction directs the user toward attachment parsing without explaining the external document-processing boundary. Public announcements reduce the usual sensitivity, but user-supplied unpublished drafts could be disclosed without informed authorization; the skill's own no-storage claim does not cover the external provider.
- Content
Attachment parsing is instructed without warning that document contents will be sent to an external service.
Medium
- Category
- Output Handling
- Confidence
- 93% confidence
- Finding
The workflow initiates a parsing channel when relevant quotations are in attachments, without explicitly warning that an external service may receive document content or requiring authorization for that disclosure. Limiting parsing to necessary attachments reduces exposure, but user-supplied drafts can still contain nonpublic information.
- Content
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
The attachment-parsing workflow lacks a warning that document contents will be sent to an external service.
Medium
- Category
- Output Handling
- Confidence
- 90% confidence
- Finding
The workflow directs attachments to an external parsing service without an explicit warning that document contents may leave the user's environment or a consent requirement before transfer. Published disclosures reduce the usual sensitivity, but user-supplied drafts or annotated attachments could contain confidential business information or employee personal data and be disclosed unintentionally.
- Content