cue-event-brief-cn

• Outcome: Review
• Latest audit: Oct 22, 2026 · 9:14 PM UTC
• Version: 0.2.22

Overview

The announcement-card workflow is coherent, but its optional connection checks have flaws that could expose your API key.

Use the local card workflow without an API key until the connection examples enforce approved HTTPS destinations and safe redirect handling. Send only public or redacted documents to Cue, confirm credit use, and review installed versions. A validator pass does not establish factual accuracy or catch every investment judgment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (25)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 84)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 88)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 82)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 86)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied code implements infrastructure connectivity diagnostics, not announcement retrieval, extraction, comparison, or card generation. It performs an anonymous catalog GET by default unless a local snapshot is supplied; --post additionally enables an authenticated tools/list request after HTTPS and hostname-suffix checks. Those safeguards constrain credential use but do not resolve the materially different purpose and undeclared resource access. No announcement-processing functionality is present in this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied chunk implements authenticated MCP service discovery rather than retrieving or analyzing company announcements or producing the declared card. Tool discovery could support a larger research workflow, but this chunk establishes no such connection and permits selection of any listed domain. It also sends a bearer credential to a catalog-provided endpoint without showing destination validation. This is an undeclared network and credential-handling capability; the code alone does not establish malicious intent or credential theft.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied chunk implements MCP catalog discovery and authenticated tool enumeration, not announcement retrieval, extraction, verification, or card generation. Remote tool discovery could support the declared workflow, but this chunk establishes no connection between the selected service and A-share announcements. Its demonstrated purpose is therefore materially different from the declared purpose. The credential transmission is explicit, though the snippet does not establish malicious exfiltration.

Content

No source excerpt is available for this finding.

The documented credential destination restrictions are not enforced across HTTP redirects.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The destination guard checks only the initial URL, while urllib.request.urlopen follows redirects automatically. For supported redirects such as HTTP 302 or 303, urllib can convert this POST to a GET while preserving the Authorization header, allowing a compromised or attacker-influenced authorized endpoint to redirect the key to an unauthorized host or an HTTP destination. This defeats the script's explicit credential-confinement guarantees and can compromise the API account despite the harmless tools/list payload.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 44)May include surrounding context.

bash

# 1. Put it in the skills directory
mkdir -p ~/.workbuddy/skills
cp -r event-brief-cn ~/.workbuddy/skills/

# 2. Copy the card template and fill it following section 1

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command invokes an unpinned npm CLI through npx and selects skill content without an immutable revision. Although this is not itself an MCP server reference, a compromised or unexpectedly changed upstream release could execute code or install adversarial agent instructions; the optional, user-initiated setup reduces immediate exposure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The per-skill installation commands leave both the npx CLI version and upstream skill revision unpinned. Selecting a named skill limits installation scope but does not prevent a changed or compromised upstream release from executing code or introducing malicious instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example sends CUE_API_KEY to a URL taken directly from a remote catalog, checking only that the URL is nonempty. A compromised or misconfigured catalog could direct the bearer token to an unauthorized host or an unencrypted HTTP endpoint; the separately described helper's destination gates do not protect this independent curl command.

Content

Scanner excerpt · README.en.md (reported line 93)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The package's own installation command also uses an unpinned executable CLI and mutable repository content. Checking that the skill name appears after installation establishes presence, not integrity, so an upstream compromise could introduce executable code or malicious agent instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r event-brief-cn ~/.workbuddy/skills/

# 2. 复制卡模板，按 §一 三步填

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command uses an unversioned npx package and an unpinned skill repository, allowing newly published or compromised upstream content to be installed. This is a supply-chain exposure rather than evidence of a malicious MCP server; optional installation reduces exposure but does not ensure integrity.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting a specific skill limits installation scope but does not pin either the npx installer or the skill's upstream revision. A compromised future package or repository update could therefore introduce executable code or adversarial agent instructions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The shell example attaches CUE_API_KEY to a URL taken directly from a remote catalog without checking its scheme or destination host. A compromised or incorrectly configured catalog could direct the request to an attacker-controlled endpoint or plaintext HTTP, exposing the bearer credential; the separately documented Python helper's checks do not protect this curl example.

Content

Scanner excerpt · README.md (reported line 91)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The self-install command retrieves the installer and skill without an immutable version constraint. Although installing the skill is an explicitly described user action, a changing or compromised upstream release could install content different from the version reviewed here.

Content

No source excerpt is available for this finding.

External attachment parsing lacks a disclosure that document contents may be sent to Cue.

Medium

• Category: Output Handling
• Confidence: 91% confidence

Finding

The workflow accepts pasted text and attachments and offers external Cue parsing, but its confirmation language emphasizes time and credits rather than explicitly disclosing document-content transmission. Public announcements reduce the usual sensitivity, but user-provided files can contain private annotations or unrelated confidential material; approval of a charge is not necessarily informed approval of disclosure.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow sends user-provided attachments and long-form announcements to a remote parsing service without a privacy warning.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The workflow directs attachments and long-form announcement content to a remote parsing channel without requiring privacy screening or informed approval for that transfer. Most intended inputs are public disclosures, which reduces typical exposure, but user attachments or pasted material can contain confidential annotations, personal information, or unpublished content; the research cost-confirmation requirement does not cover parsing privacy.

Content

No source excerpt is available for this finding.

The validator exempts the entire pending-review section from the documented mandatory [待人工] labeling rule.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The and not in_pending condition allows rating, target-price, and price-trend statements anywhere in the pending-review section without an individual [待人工] label; the separate coverage check requires only one such label somewhere in that section. A crafted card can therefore pass validation with an unrelated placeholder label alongside unmarked investment judgments, contrary to the documented mandatory-label rule. The financial context makes this validation bypass consequential, although placement under a pending-review heading provides some mitigating context and the script itself performs no trades.

Content

No source excerpt is available for this finding.

The claimed no-network default still performs an external catalog request without --post.

Medium

• Category: Excessive Agency
• Confidence: 100% confidence

Finding

Despite repeated claims that the default sends no packets, main calls read_catalog before checking --post, producing an external GET unless --catalog-file is supplied. The catalog fetch is also disclosed elsewhere and carries no API key, which limits severity, but users relying on the stronger no-network promise can unintentionally disclose their source IP and request timing to the catalog service.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.