定增条款

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 12:56 AM UTC
• Version: 0.1.0

Overview

The skill coherently extracts disclosure terms, though its optional cloud services and imperfect checker require care.

Use supplied public text to avoid optional external processing. Before enabling Cue, verify its HTTPS endpoints, charges and retention terms, and authorize any confidential-document uploads. Keep the API key outside chat and review optional downloads. Manually verify quotations and recommendations even after the checker reports PASS; its missing-row bypass was reproduced. Separate Cue implementations were not audited.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (16)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk tests access to an MCP catalog and lists tools on an authenticated endpoint. It does not retrieve or analyze a refinancing disclosure, extract any of the ten declared term categories, or produce citations and missing-term markers. Network access could support the declared task, but this chunk establishes no connection between these connectivity checks and that task; its demonstrated purpose is service discovery and authentication testing. The code does not establish malicious credential exfiltration, since the routing URL's destination is unspecified.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied shell commands test MCP catalog accessibility and authenticated tool enumeration. They do not retrieve or parse a placement announcement, extract the ten declared terms, or produce quotations and anchors. No connection is established between these service-discovery operations and the declared document-analysis workflow, so the chunk demonstrates a materially different purpose and access to unrelated resources. The shown requests enumerate tools; they do not invoke those tools.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash

# 1. drop it into the skills directory
mkdir -p ~/.workbuddy/skills
cp -r placement-terms-cn ~/.workbuddy/skills/

# 2. ask the agent for the five-section card defined in SKILL.md and save it as my-placement-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r placement-terms-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的条款卡五段出卡，产物存成我的定增卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command leaves both the npx-executed skills package and the source repository revision unpinned. Although this is a skill installer rather than an MCP server launch, compromised or unexpectedly changed upstream content could execute installer code or introduce malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The whole-set installation command retrieves a mutable skills collection using an unversioned npx package. Its optional setup role reduces automatic exposure, but following it can still introduce compromised installer code or unreviewed skill instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting one skill narrows installation scope but does not pin either the installer package or the skill's upstream revision. A compromised or changed dependency could therefore supply code or agent instructions different from those originally reviewed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

The tools/list request is legitimate authentication, not document exfiltration, but its destination is taken from a live catalog without an explicit endpoint trust check. If the catalog or selected routing entry is compromised, the command can send the bearer credential directly to an attacker-controlled endpoint.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take the domain's routing.url and transport from that response; do not copy the host into a config by hand

3) with a key, send tools/list — proves only that this data-leg endpoint accepts the key, and proves nothing about other entries

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The instruction to start attachment parsing lacks a warning about sending proposal material to an external service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The recovery instruction encourages external attachment parsing without explaining what document content or locators leave the user's environment. Public disclosures usually have low confidentiality, but user-supplied files or private attachment links could expose sensitive material without informed approval.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command installs the skill through an unversioned npx package and a mutable repository reference. Although not an MCP server invocation, this creates a supply-chain path for compromised installer code or changed agent instructions.

Content

No source excerpt is available for this finding.

The optional Cue attachment-parsing workflow lacks a disclosure that document contents are sent to a third-party service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The optional parsing setup names an external service but does not clearly disclose that document text, files, or retrieval locators may be sent to it. Most intended inputs are public filings, which lowers risk, but the same workflow accepts user-provided documents that may contain confidential information.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The collection installation uses mutable upstream versions for both the CLI and skill content. User selection makes the workflow explicit, but does not prevent malicious or unexpectedly changed upstream packages from entering the agent environment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The single-skill selector limits breadth but leaves the npx installer and selected repository content unpinned. Following this command after an upstream compromise could execute altered installer code or install malicious skill behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

Authenticated tool enumeration is expected for this integration, but the bearer key is sent to a catalog-selected URL with no stated origin validation. A malicious routing entry could redirect the initial credential-bearing request to an attacker without needing an HTTP redirect.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Missing-term rows bypass the documented prohibition on unmarked investment recommendations.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

A recognized term row containing 未检索到 triggers continue before the banned-recommendation check runs. Consequently, a missing-term row can also contain an unmarked recommendation such as 建议参与 and escape F-LINE, undermining a financial-output safety gate even when the missing count reconciles.

Content

No source excerpt is available for this finding.