Security audit
Security checks for vulnerabilities and agentic risk
The insurance-summary workflow is coherent, but optional external PDF processing lacks clear controls for sharing private documents.
For private policies, use supplied text without optional Cue processing unless you authorize sharing. Before enabling parsing, confirm what will be sent, who receives it, and retention terms; the companion service's live behavior was not verified. Verify the credential destination and install only needed components from reviewed versions. The review concern is document-sharing control, with no artifact evidence of intentional theft or malicious persistence.
所给代码执行的是 MCP 目录访问及带凭据的工具列表查询，没有读取保险条款、提取八项信息或生成带原文锚点的速读卡。虽然远程工具调用可能作为某些技能的实现细节，但此代码未体现它与保险条款处理之间的关系，实际展示的资源访问与功能均不在声明用途之内。代码使用密钥进行认证，但仅凭该片段不能认定存在密钥窃取或恶意外传。
所给代码的主要功能是外部 MCP 服务发现与连接验证，没有读取保险条款、提取八项内容、生成原文锚点或标记待人工事项的逻辑。代码也未表明这些网络请求是保险条款处理的必要支撑，因此其主要用途与访问资源均与声明明显不符。代码仅发送工具列表请求，没有证据表明其执行了列出的工具或上传了保险文档。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
mkdir -p ~/.workbuddy/skills
cp -r insurance-terms-cn ~/.workbuddy/skills/
# ask the agent for the five-section card defined in SKILL.md, save it as my-insurance-card.md
python3 ~/.workbuddy/skills/insurance-terms-cn/scripts/check_insurance_card.py ./my-insurance-card.md
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r insurance-terms-cn ~/.workbuddy/skills/
# 2. 让 agent 按 SKILL.md 的保险卡五段出卡，产物存成我的保险卡.md
The installation command leaves both the npx installer version and the skill repository revision unpinned. A compromised or unexpected upstream release could execute code or install adversarial agent instructions with the user's permissions; this is a supply-chain weakness, not evidence of current malicious behavior.
The optional collection-install command executes an unpinned npx package and retrieves mutable upstream skill content. Compromise of either dependency could introduce executable code or persistent agent instructions, and the collection command has broader installation scope than a single-skill command.
Selecting one skill reduces installation scope but does not pin the npx installer or the upstream repository revision. A compromised update could therefore run with local permissions or alter the agent's behavior, including behavior involving documents and service credentials.
Authenticated tools/list discovery is legitimate, and the request body contains no policy document. However, the example sends a bearer credential to a catalog-derived URL without specifying HTTPS or an approved credential audience, so a compromised catalog or incorrect routing value could disclose the key to an unintended endpoint.
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400
The recovery workflow recommends attachment parsing through an external service without explaining the document-disclosure boundary or requiring approval. Public policy wording is usually low sensitivity, but personalized policy attachments can contain identity, financial, or health information; the local non-storage statement does not establish the external service's retention behavior.
The command installs the skill through an unversioned npx installer and a mutable repository reference. Although its stated scope is one package, a compromised upstream version could execute code or install malicious agent instructions with local user privileges.
The collection installation uses an unpinned executable installer and mutable upstream content. Interactive selection limits which skills are installed but does not protect against a compromised installer or changed skill instructions.
The single-skill command narrows scope but still resolves an unpinned npx package and mutable repository revision. Upstream compromise could introduce local code execution or agent instructions that misuse the documents and services available to the skill.
The tools/list request is a normal authenticated connectivity check, not evidence of intentional exfiltration. Nevertheless, it attaches the API key to a dynamically supplied routing URL without documented scheme or destination validation, allowing malicious or erroneous routing metadata to redirect the credential.
curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400
The troubleshooting step recommends starting external attachment parsing without a privacy notice or explicit transmission approval. Generic policy text may be public, but user-supplied PDFs can contain personal, financial, or health data, making undisclosed external processing a meaningful confidentiality risk.
The operational instructions route long attachments through an external parsing channel when needed, but do not require disclosure or approval of that transfer. The restriction to necessary attachments reduces exposure, yet personalized insurance PDFs can still disclose sensitive identity, financial, or health information; treating parsed text as data addresses injection, not privacy.
Without declared permissions the skill's intent is opaque and cannot be validated.
The workflow directs attachment and PDF parsing through an external service without requiring a privacy disclosure or informed approval before document content is transmitted. Although generic policy terms may be public, user-supplied insurance documents can contain identity, health, beneficiary, and financial information, making an unreviewed upload potentially serious; limiting when parsing starts does not establish permission to disclose that content.
L197 explicitly documents “本件不读网络、不读目录,” but L185 calls root.iterdir() on the system temporary directory. This inspects directory entries beyond the temporary roots created by this invocation, although it does not read those entries' file contents.