公开资料变化与证据简报

• Outcome: Review
• Latest audit: Oct 22, 2026 · 7:00 PM UTC
• Version: 0.3.11

Overview

This public-document research skill needs review because its numeric checks and page citations provide less assurance than advertised.

Start with the offline demo and verify numbers and page references against original documents before relying on results. Treat financial strengths and causal links as heuristics, even when adjacent excerpts are verbatim. Review installation dependencies and submit only authorized public material to cloud parsing. The evidence supports review for misleading verification guarantees, not a malicious verdict.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The description limits the numeric tool to source-consistency checks and excludes risk discovery, but the numeric workflow explicitly describes threshold-based driver strength, financial classification, and possible causal links. This capability mismatch can cause users or routing agents to mistake interpretive financial outputs for mechanically verified evidence; human-review warnings reduce, but do not eliminate, that risk, and the supplied material does not independently establish every alleged code-level calculation.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

This finding describes the same capability-disclosure problem: the provided workflow assigns driver strength and orders consequences by possible explanatory drivers despite advertising verification-only behavior. Such interpretations can acquire unwarranted authority from adjacent byte-verified evidence, although the specific 30% threshold cannot be verified from the supplied SKILL.md.

Content

No source excerpt is available for this finding.

The numeric pack performs credit-risk detection and causal interpretation despite the manifest explicitly excluding risk discovery.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The metadata excludes risk discovery, but the implementation detects financial deterioration, assigns strengths, and produces causal links between financial outcomes and purported drivers. This violates the advertised analytical boundary and can cause downstream agents to present heuristic associations as evidence-supported conclusions; the financial context increases the consequences, although the human-review disclaimer reduces reliance somewhat.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documented npx skills add huhoo/cue-awesome --skill cue-omni-ontology command can download and execute an unpinned npm CLI, exposing the user's environment to compromised or unexpectedly changed releases. This is a CLI installation dependency, not an MCP server as the finding states, but the reproducibility and supply-chain concern remains; the offline demo and credential-handling guidance do not protect this installation step.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The installation command uses npx skills without pinning the npm package version, allowing remotely supplied CLI code to execute with the invoking user's permissions. A compromised or malicious future release could therefore affect users following these instructions; the benign installation context and absence of automatic execution reduce immediate exposure but do not eliminate the supply-chain risk. The scanner's MCP characterization is inaccurate: this command installs a skill rather than specifying an MCP server.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.en.md (reported line 19)May include surrounding context.

md

## Start with the user's task

Choose **demo**, **build**, **update**, or **answer** from the request. Default to one company/product topic and 2–5 explicitly supplied public sources. Resolve genuine subject ambiguity; otherwise preserve the user's scope and proceed. Use available current-session authorizations without asking again.

- Build: “Organize this company's businesses and metrics from these reports, with evidence.”
- Update: “Add this announcement to the previous package and show what changed.”

The numeric workflow adds credit-risk classification and causal ranking despite the manifest limiting it to source-text validation and explicitly excluding risk discovery.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The numeric workflow assigns credit-risk driver strengths and ranks plausible causes, exceeding the advertised source-text validation function and exclusion of risk discovery. This scope mismatch could cause users to receive consequential financial assessments under the apparent assurance of evidence validation, even though verbatim-source checks do not validate thresholds or causal relationships. The explicit review-only disclaimer, unfavorable backtest disclosure, and absence of automated financial actions reduce the danger but do not eliminate the mismatch.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The numeric workflow performs risk-oriented classification and causal ranking despite the manifest limiting it to source-text verification and explicitly excluding risk discovery.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The numeric workflow expressly includes risk-oriented categories, strength levels, causal ordering, and downgrading of drivers for certain accounting or acquisition explanations, exceeding source-text verification. These judgments could influence financial review without the scrutiny users would apply to an explicitly interpretive tool; the stated lack of credit-scoring validity and requirement for human review are meaningful mitigations.

Content

No source excerpt is available for this finding.

Numeric validation does not establish that submitted figures appear in the cited source pages.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The validator checks that a value is finite and its cited page exists, but the excerpt is optional and, when supplied, need not contain or support that value. An input author can therefore submit fabricated but internally consistent figures with valid page references and obtain a packaged result that appears source-validated, undermining the skill's central evidence guarantee.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/omni_source.py (reported line 47)May include surrounding context.

python

import queue, shlex, subprocess, threading
        cmd = cmd or os.environ.get("CUE_OMNI_BRIDGE") or BRIDGE_DEFAULT
        try:
            self.p = subprocess.Popen(shlex.split(cmd), stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                                      stderr=subprocess.DEVNULL, text=True, bufsize=1)
        except OSError as e:
            raise OmniError(f"cannot start the Omni Bridge ({cmd.split()[0]}): {e.strerror}; set CUE_OMNI_BRIDGE to your omni-reader MCP command")

Tainted flow: 'cmd' from os.environ.get (line 45, credential/environment) → subprocess.Popen (code execution)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/omni_source.py (reported line 47)May include surrounding context.

python

import queue, shlex, subprocess, threading
        cmd = cmd or os.environ.get("CUE_OMNI_BRIDGE") or BRIDGE_DEFAULT
        try:
            self.p = subprocess.Popen(shlex.split(cmd), stdin=subprocess.PIPE, stdout=subprocess.PIPE,
                                      stderr=subprocess.DEVNULL, text=True, bufsize=1)
        except OSError as e:
            raise OmniError(f"cannot start the Omni Bridge ({cmd.split()[0]}): {e.strerror}; set CUE_OMNI_BRIDGE to your omni-reader MCP command")

Page-span merging assigns native page evidence to segments documented as remaining uncovered.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Skipped grounding segments do not create a merge barrier: a later accepted segment on the same page extends the previous span across the entire intervening gap, including text explicitly rejected as unanchored, multi-page, or otherwise unsuitable for native-page evidence. In this evidence-packaging skill, that can falsely attribute attacker-supplied or ambiguous text to a specific PDF page, undermining citation integrity and downstream numeric verification; a content digest does not validate the page mapping.

Content

No source excerpt is available for this finding.

Numeric-pack tests require financial-risk interpretation beyond the manifest's evidence-validation-only scope.

Medium

• Category: Excessive Agency
• Confidence: 96% confidence

Finding

The manifest limits the optional numeric pack to verifying host-computed numbers against verbatim source evidence and explicitly excludes risk discovery. These tests require numeric views to derive collection-related drivers with a strength score, link them to profit consequences, and rank drivers before consequences; L133-L134 additionally require a guarantee-related driver based on a percentage threshold. This encodes financial-risk and causal interpretation rather than merely validating or presenting supplied evidence.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/test_ontology.py (reported line 668)May include surrounding context.

python

calls = []

        class FakeBridge:
            def tool(self, name, args, timeout=0):
                calls.append(args)
                part, i = args["cursor"].split(":")[1], int(args["cursor"].split(":")[2])
                text = content if part == "content" else grounding

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/test_ontology.py (reported line 685)May include surrounding context.

python

self.assertFalse((self.root / "b").exists())

        class Expired:
            def tool(self, name, args, timeout=0):
                return {"status": "failed", "error": {"code": "RESULT_EXPIRED", "billed": False}}
        with self.assertRaisesRegex(self.om.OmniError, "expired"):
            self.om.build_source(self.save(self.response("artifact"), "e.json"), self.root / "c", self.meta, bridge=Expired())

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/ontology.py (reported line 605)May include surrounding context.

python

def query(k, args):
    args = coerce_query_args(args)
    for field in ("valid_from", "valid_to"):
        if getattr(args, field, None) is not None:
            iso_date(getattr(args, field), field)
    matches = [a for a in k["assertions"] if a["status"] != "rejected" and all(
        getattr(args, arg, None) is None or a[field] == getattr(args, arg)

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/ontology.py (reported line 606)May include surrounding context.

python

args = coerce_query_args(args)
    for field in ("valid_from", "valid_to"):
        if getattr(args, field, None) is not None:
            iso_date(getattr(args, field), field)
    matches = [a for a in k["assertions"] if a["status"] != "rejected" and all(
        getattr(args, arg, None) is None or a[field] == getattr(args, arg)
        for arg, field in (("entity", "entity_id"), ("concept", "concept_id"), ("period", "period"), ("basis", "basis"),

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/ontology.py (reported line 608)May include surrounding context.

python

if getattr(args, field, None) is not None:
            iso_date(getattr(args, field), field)
    matches = [a for a in k["assertions"] if a["status"] != "rejected" and all(
        getattr(args, arg, None) is None or a[field] == getattr(args, arg)
        for arg, field in (("entity", "entity_id"), ("concept", "concept_id"), ("period", "period"), ("basis", "basis"),
                           ("unit", "unit"), ("valid_from", "valid_from"), ("valid_to", "valid_to"), ("fact", "fact_id")))]
    if getattr(args, "qualifiers", None) is not None:

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/ontology.py (reported line 608)May include surrounding context.

python

if getattr(args, field, None) is not None:
            iso_date(getattr(args, field), field)
    matches = [a for a in k["assertions"] if a["status"] != "rejected" and all(
        getattr(args, arg, None) is None or a[field] == getattr(args, arg)
        for arg, field in (("entity", "entity_id"), ("concept", "concept_id"), ("period", "period"), ("basis", "basis"),
                           ("unit", "unit"), ("valid_from", "valid_from"), ("valid_to", "valid_to"), ("fact", "fact_id")))]
    if getattr(args, "qualifiers", None) is not None:

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: scripts/test_ontology.py:20