ClawHub
Back to skill

Security audit

cue-ic-memo-cn

Security checks for vulnerabilities and agentic risk

Overview

This memo-drafting skill needs review because its connection setup can expose your API key and its evidence checks can miss unsupported claims.

Use the local drafting path until API-key destination checks protect both the shell example and redirects. Approve any external processing of confidential documents explicitly. Independently verify citations even after a checker PASS, and install reviewed, pinned versions.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (40)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python
code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 109)May include surrounding context.

bash
   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 113)May include surrounding context.

md
rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 109)May include surrounding context.

bash
   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 113)May include surrounding context.

md
rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

The supplied chunk has a materially different operational purpose: testing an API channel rather than producing or validating investment memoranda. Connectivity checks could support a broader research workflow, but this code does not connect its catalog discovery and credentialed requests to any declared memorandum-generation function. The explicit --post requirement and destination checks constrain credential transmission but do not make that capability part of the declared purpose. Also, without --post, the script normally still performs an anonymous catalog GET; it only avoids the authenticated POST.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The supplied chunk implements a generic authenticated MCP tool-discovery workflow. It contains no company-input processing, memorandum generation, source-location tracking, missing-data handling, or opposing-argument validation. Tool discovery could support a larger application, but this chunk does not establish any connection to the declared memorandum task or its disclosure/regulatory sources. The mismatch is the materially different demonstrated purpose and resource access, not evidence that the credential transmission is malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The supplied chunk implements authenticated MCP service discovery rather than memorandum generation, citation tracing, or the declared content checks. Tool discovery could support the declared workflow, but this chunk neither restricts the selected domain to relevant financial sources nor establishes that connection. It also sends CUE_API_KEY to the catalog-provided endpoint, a trust-boundary crossing not represented in the description. This does not establish malicious intent or disclosure of investment materials, but the observable capabilities materially exceed what the declared purpose explains.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md
--manual-bull` 或人工转写补，缺它照样不成文（退 1）。三链各一条真跑样例见 `scripts/fixtures/upstream/` 与 `scripts/fixtures/run_upstream_chains.sh`。

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.

md
- 细则（各腿取什么、截断与口径怎么写）仍看 `README.md` 的 §1-§3 与 §5；本节只保证「照 §1 的主键与 §2 的腿取到数之后，一支命令能落成并自证」。

The validator can accept numeric tables without the source and location fields promised by the manifest.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

Source checking is skipped when the source-column header is absent, while location checking runs only if the location header and corresponding cell exist. An edited memo can therefore retain numeric claims, omit these required evidence fields, and still pass with matching ledger counts, undermining the skill's promised traceability even though the checker explicitly disclaims factual verification.

Content

No source excerpt is available for this finding.

The credential destination guarantee does not hold across HTTP redirects.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

The destination guard validates only the initial URL, while urllib.request.urlopen follows supported redirects automatically and can forward the explicitly supplied Authorization header to another host or an HTTP destination. An attacker controlling an accepted endpoint or its redirect behavior could therefore steal CUE_API_KEY despite the stated credential-destination guarantee; --post opt-in does not authorize that secondary destination.

Content

No source excerpt is available for this finding.

来源索引解析扫描全文，而不是仅解析声明的「来源索引」节。

High
Category
Excessive Agency
Confidence
99% confidence
Finding

ledger_from_index scans the entire untrusted artifact, so a matching bullet outside the declared source-index section can register a fabricated source or overwrite an existing source ID. main also merges these entries after the separately supplied sources, allowing artifact content to override that ledger and make unsupported financial claims appear traceable. This undermines the skill’s central provenance guarantee, although draft-only use and human review reduce immediate decision impact.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
88% confidence
Finding

The documented installation command, npx skills add huhoo/cue-awesome --skill ic-memo-cn, can download and execute an unpinned npm CLI, exposing users to compromised or unexpectedly changed package releases. The scanner incorrectly describes this as an MCP server reference, but the underlying supply-chain concern is valid; placement in a historical changelog reduces immediate exposure, and nothing here establishes malicious intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 44)May include surrounding context.

bash
# 1. Put it in the skills directory
mkdir -p ~/.workbuddy/skills
cp -r ic-memo-cn ~/.workbuddy/skills/

# 2. Settle the subject -> transcribe and build -> pass the gate (section 1)

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command invokes an unpinned npm CLI and selects skill content from a mutable repository reference. Although this is an installer rather than an MCP server, compromised future releases or repository changes could introduce executable code or malicious agent instructions into the local environment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

Selecting an individual skill narrows installation scope but does not pin either the npx-executed installer or the repository content. A compromised upstream update could therefore execute locally or install adversarial instructions; the document provides no immutable-version or integrity requirement.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The shell example attaches CUE_API_KEY to a destination taken directly from the catalog without validating its scheme or host. A compromised or misconfigured catalog could direct the bearer token to an attacker-controlled endpoint or an unencrypted HTTP destination; the separately described Python script's destination checks do not protect this shell command.

Content

Scanner excerpt · README.en.md (reported line 118)May include surrounding context.

md
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The command installing this package also relies on an unpinned npx installer and mutable repository content. Restricting installation to ic-memo-cn does not prevent a compromised installer or changed skill revision from affecting the agent environment.

Content

No source excerpt is available for this finding.

The materials workflow routes PDFs and internal files through an external parsing channel without a privacy warning.

Medium
Category
Output Handling
Confidence
91% confidence
Finding

The materials workflow includes sending internal files through an external parsing service without a clear confidentiality warning or data-disclosure approval requirement. Investment-committee materials may contain sensitive financial or business information, and approval of processing cost does not establish authorization to disclose that information to a third party.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 44)May include surrounding context.

bash
# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r ic-memo-cn ~/.workbuddy/skills/

# 2. 定主体 → 转写落成 → 过机检（三步见 §一）

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The installation command runs an unpinned npm CLI through npx and installs skills from a mutable repository reference. Although this is not itself an MCP-server version declaration, compromised or unexpected upstream updates could execute code during installation or introduce adversarial instructions into the agent's skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

Selecting an individual skill limits installation scope but does not pin either the npx CLI or the repository content. Future or compromised upstream releases could therefore change the executable installer or the instructions trusted by the agent.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
97% confidence
Finding

Sending a service key to its authorized endpoint is legitimate, but this shell example attaches the bearer key to a URL taken directly from catalog data without validating its scheme or host. A compromised or incorrectly configured catalog could direct the key to an attacker or an HTTP endpoint; the separately described helper's destination checks do not protect this curl command.

Content

Scanner excerpt · README.md (reported line 118)May include surrounding context.

md
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
93% confidence
Finding

The command for installing this skill also relies on an unpinned npx CLI and mutable repository content. This creates a supply-chain exposure even though the documented installation is relevant to the task and shows no clear malicious intent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.