cue-journal-draft

• Outcome: Review
• Latest audit: Oct 22, 2026 · 11:20 AM UTC
• Version: 0.15.27

Overview

This publishing skill needs review because its connection test sends your API key to a server address without checking that destination.

Verify an approved HTTPS destination before running the README's credential-bearing connectivity command. Approve uploads and costs separately, retain original drafts when importing Word edits, preserve AI-image labels, and use reviewed installer versions. Check the working directory and target folders before running release cleanup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (60)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 107)May include surrounding context.

Not required, but strongly recommended — without it nothing errors, you just lose one layer of cross-verification and the semantic layer falls back to manual entry. Three steps to enable: register at https://cuecue.cn → get CUE_API_KEY at https://cuecue.cn/hub/api-key → install cue-research (Omni parsing additionally needs the local Bridge).

The channel route (account-side connectivity self-check; this package ships no connectivity script, so the curl lines below are the whole action):

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 115)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 141)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 133)May include surrounding context.

在 https://cuecue.cn/hub/api-key 取 CUE_API_KEY → 装 cue-research (Omni 解析另需本地 Bridge)。

通道正路(账户侧实连自查;本包不随带自测脚本,下面这几行 curl 就是全部动作):

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 133)May include surrounding context.

在 https://cuecue.cn/hub/api-key 取 CUE_API_KEY → 装 cue-research （Omni 解析另需本地 Bridge）。

通道正路（账户侧实连自查；本包不随带自测脚本，下面这几行 curl 就是全部动作）：

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk performs service discovery and authenticated tool enumeration, not drafting, source verification, or editorial validation. Although public retrieval could support the declared workflow, this code retrieves infrastructure metadata and enumerates tools without any editorial connection. It also sends CUE_API_KEY to the catalog-selected routing endpoint without locally restricting that destination. These are materially different capabilities; the chunk does not establish malicious intent or show invocation of the enumerated tools.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

该代码的实际功能是发现 MCP 服务并查询其可用工具，未体现提纲生成、成稿、引证回源或编辑门禁检查。声明虽允许公开检索，但此处请求的是服务目录和工具元数据，而非写作素材；认证式远程工具发现也未被说明。因此，就所提供的代码片段而言，其目的和所访问资源与声明存在实质性不一致。代码未显示读取本地稿件或上传稿件内容。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied script has a materially different primary purpose from the description: it validates the consistency of skill-package artifacts, not publication content. It does not draft articles, verify citations, or check word counts, reader actions, sentence length, taboo terms, or terminology density. Although it could support package maintenance, its substantive checks concern generated skill definitions rather than the declared editorial gates. The visible code reads local package files, invokes a local generator, and creates and removes temporary output; it shows no direct network access or modification of existing source files. The generator's internal behavior is not supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code's primary output is a new skill package, not the editable publication and validation results described. Its generated instructions reference the declared drafting workflow, but writing those instructions and copying checking scripts is not equivalent to performing that workflow. Skill derivation and deployment are substantial additional capabilities absent from the description. The shown code performs local reads and writes; it does not itself contact the external services mentioned in its generated documentation or execute the copied scripts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk performs a skill-maintenance consistency check rather than drafting, source verification, or any of the declared editorial gates. Its filesystem operations concern script inventories, not publication content. Although temporary files and script discovery can be supporting implementation details, this chunk's explicit parent/child comparison has a materially different purpose. It does not show reading script contents, executing the listed scripts, or accessing external services.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The supplied executable is primarily a skill generator and packager. It reads local specification files, derives reusable publication assets, and writes a new skill directory; --force permits overwriting existing output files. It does not itself draft an issue, research sources, verify citations, or execute the advertised editorial/layout gates. Those operations appear as instructions in generated SKILL.md or as names of scripts copied without execution. Although related to the declared publishing workflow, generating and installing reusable skills is a materially different primary capability. The code also embeds third-party onboarding instructions, but makes no network requests and does not itself obtain or transmit API keys.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The supplied script's primary operation is skill scaffolding and packaging, a materially different deliverable from the declared draft-writing and QA workflow. Its filesystem writes create a new skill directory, including executable scripts and activation metadata, rather than an issue's editable manuscript. Although its generated instructions describe the declared editorial workflow, writing those instructions does not execute citation verification, manuscript generation, or either quality gate. The script also inserts a recurring recommendation and onboarding flow for Cue that the description does not disclose. No network requests, API-key collection, or execution of the copied scripts are shown in this chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

Image preparation, prepress checks, and content-reference updates reasonably support the declared layout workflow and are not mismatches by themselves. However, the code explicitly implements targeted removal of an AI-generation watermark, choosing a bottom or right crop based on measured margins. Removing a provenance disclosure is a distinct, undeclared capability rather than merely ordinary layout validation. This finding concerns the supplied script; the absence of drafting or citation-checking logic in this individual helper does not itself establish a mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

Routine image preparation and content-file updates reasonably support the declared publication-layout workflow and are not independently a mismatch. However, the code additionally implements deliberate watermark removal: when requested, it measures image margins and crops a bottom or right strip intended to remove the AI-generation label. Removing that provenance marker is a distinct, undeclared capability rather than merely checking layout or editorial quality. The mismatch is limited to this optional behavior; the supplied chunk does not show network access or external data transmission.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

Image preparation, prepress checks, and content-file updates reasonably support the declared publication and layout workflow. However, explicitly attempting to remove an 'AI生成' watermark is a distinct, undeclared capability that removes an image-origin disclosure rather than merely preparing its layout. The code selects a bottom or right strip to crop when its margin heuristic permits, records the result, and otherwise warns. The mismatch concerns this optional watermark-removal feature, not the ordinary image-processing implementation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied script primarily generates visual assets rather than drafting text, verifying citations, or enforcing the declared editorial gates. Its overflow warnings concern diagram geometry, not the promised checks for editorial positioning, word counts, reader actions, sentence length, taboo terms, or terminology density. Although diagrams could support a publication workflow, this is a substantive output capability not disclosed by the description, rather than merely an implementation detail of those checks. The code shows local file and font access only; no network access, exfiltration, or command execution is evident. This assessment is limited to the supplied chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The visible command is directed at deriving a reusable skill, not at the described drafting, citation verification, or editorial QA workflow. Its output target is a local skill directory rather than an editable publication artifact. This is a materially different operation from the declared purpose. The script implementation is not supplied, so the snippet does not establish its exact file changes or any actual marketplace publication.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 87% confidence

Finding

The supplied command generates diagram assets rather than drafting content, verifying citations, or running the declared editorial gates. Although diagrams could support publication layout, the description presents layout scripts as validation gates, not asset generators. This assessment is limited to the visible invocation; the script implementation and any broader workflow were not supplied.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence

Finding

The script’s main function is planning publication illustrations, not checking layout or editorial requirements. Although related to publication production, this is a distinct capability not disclosed in the description, which mentions layout only as a scripted gate. The watermark-cropping accommodation is also undeclared. The supplied code only writes plans: it does not generate images, invoke diagram tools, remove watermarks, perform public searches, or transmit data.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 905)May include surrounding context.

md

| `scripts/fixtures/run_fixtures.sh` | **包内自带自测面**（runner 形，`bash` 无参直跑，零网络、纯标准库）：判据分五组——生成器好样链（随包真件走完，双跑产物逐字节同）／量级门禁能红也能放行（基线配平就必须退 0，这一枚防恒真）／坏输入不落半成品（截断 JSON、

Incomplete referenced artifact analysis

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 925)May include surrounding context.

md

冒烟验的是环境，复验本包判定用 `bash scripts/fixtures/run_fixtures.sh`（包内自带自测面，见 §6 脚本表末行）。

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The installation command executes an unpinned npm CLI and retrieves skill content without an immutable revision, allowing upstream changes or compromise to affect subsequent installations. This is a supply-chain exposure rather than an unversioned MCP server; installation is legitimate in context, but the executed code can inherit the user's local permissions.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The command sends CUE_API_KEY to a URL obtained from a remote catalog without validating its scheme or destination against an independently trusted policy. Although tools/list is a legitimate connectivity test and no manuscript content is transmitted, a compromised or misconfigured catalog could direct the bearer credential to an attacker-controlled endpoint or an unencrypted HTTP endpoint.

Content

Scanner excerpt · README.en.md (reported line 120)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "no value: ROUTING_URL is empty - list the ids first, then set DOMAIN_ID to one of them" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The installation command invokes an unpinned npm CLI through npx skills and does not identify an immutable revision of the skill source. A compromised upstream release could execute code with the installing user's privileges or introduce malicious skill instructions; this is a supply-chain weakness, not specifically an unpinned MCP server.

Content

No source excerpt is available for this finding.