cue-event-risk-scan

• Outcome: Review
• Latest audit: Oct 22, 2026 · 8:05 PM UTC
• Version: 0.2.22

Overview

This company-research skill needs review because its connection examples could expose your Cue API key to an unapproved destination.

Use the manual/offline workflow until both credential-bearing paths enforce approved HTTPS destinations and safe redirect handling. Avoid running the unchanged README POST with a live key. Online searches disclose company names or codes to Cue; approve that sharing and any costs. Review and pin optional installation sources.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (20)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 85)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 89)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 85)May include surrounding context.

bash

   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 89)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Automatic redirects bypass the documented HTTPS and authorized-host credential checks.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The credential-bearing request uses urllib.request.urlopen's default redirect handling, which can follow a POST's 301/302/303 response as a GET while retaining its Authorization header, without rerunning guard_credential_target. A compromised authorized endpoint or an exploitable redirect on it could therefore send CUE_API_KEY to an unauthorized host or an HTTP destination. The explicit --post requirement limits exposure, but this skill's legitimate use of a live API credential makes the bypass consequential.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

The retrieval workflow does not warn that company identifiers and search queries are sent to the third-party Cue service.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

The workflow instructs the agent to run external retrievals, including searches for both short and full company names. Although the README explains Cue setup, credential handling, and expected spending, it does not disclose that these searches transmit the user's chosen investigation subject to a third party, potentially revealing research interests.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 42)May include surrounding context.

bash

# 1. Put it in the skills directory
mkdir -p ~/.workbuddy/skills
cp -r event-risk-scan ~/.workbuddy/skills/

# 2. Copy the card template and fill it following section 1

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses an unpinned npx package and an unpinned remote skill collection, so its behavior can change without changes to this README. Although this is an ordinary installation workflow rather than evidence of malicious intent, a compromised upstream release could execute code or install adversarial agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Selecting only cue-data-mcp limits installation scope but does not pin either the npx installer or the remote skill revision. Upstream compromise or unexpected updates could therefore introduce executable code or malicious instructions into the agent's retrieval workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example copies a destination URL from the live catalog and sends the API key to it without checking its scheme or authorized hostname. A compromised or misconfigured catalog could direct the bearer token to an attacker-controlled endpoint or an unencrypted HTTP URL; the separately described Python helper's safeguards do not protect this shell command.

Content

Scanner excerpt · README.en.md (reported line 94)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The self-installation command resolves both an unpinned installer and mutable repository content. Installing only this package reduces scope but does not prevent a later upstream change from supplying malicious files or agent instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 42)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r event-risk-scan ~/.workbuddy/skills/

# 2. 复制卡模板，按 §一 三步填

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command runs an unpinned npm installer and installs skills from a mutable repository reference. Although the detector incorrectly describes this as an MCP server version issue, compromised or unexpectedly changed installer or skill content could introduce code or agent instructions with access to the user's environment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting only cue-data-mcp limits installation scope but does not pin either the npx installer or the repository revision. A supply-chain compromise could therefore alter the installed data-access skill, which is intended to operate alongside API credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

Sending a bearer token to the intended API is legitimate, but this shell example sends it to a catalog-provided URL without checking the destination host or requiring HTTPS. A compromised or misconfigured catalog can direct the token to an attacker or a plaintext endpoint; the safeguards described for the separate Python helper are absent from this shell path.

Content

Scanner excerpt · README.md (reported line 94)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The self-installation command also uses an unpinned npx package and mutable skill repository content. Naming a specific skill does not establish integrity, so later repository or package changes can cause users to install different, potentially hostile content.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The scanning workflow lacks a privacy notice that company identifiers will be sent to external data services.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow instructs the agent to run source queries for the supplied company, using the external catalog and channel-based retrieval described earlier. It does not warn users that their company name or code will be disclosed to those services, which can reveal the subject of a confidential investigation or due-diligence request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.