招股书速览

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 2:14 AM UTC
• Version: 0.1.1

Overview

The skill coherently summarizes prospectuses, with disclosed optional cloud services and ordinary installation and privacy precautions.

Use supplied text without Cue integrations when external processing is unnecessary. Before enabling Cue, verify that credential destinations are legitimate HTTPS service endpoints and check retention terms before sending confidential drafts or annotations. Keep keys out of chat. Review optional companion skills separately and prefer pinned installation versions. Live service behavior and companion implementations were outside this artifact review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk demonstrates MCP endpoint discovery and authenticated tool enumeration. It neither processes a prospectus nor produces any of the eight declared summary cards or page anchors. No connection between these network operations and prospectus analysis is established, so they represent materially different behavior rather than demonstrated supporting implementation details. The chunk does not establish malicious intent or document exfiltration.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The supplied chunk contains no prospectus ingestion, document search, quotation extraction, page anchoring, or eight-card generation. Its demonstrated purpose is checking remote MCP access and listing available tools. Although network access could support a document-processing workflow, this chunk establishes no such connection, making the observed behavior materially different from the declared purpose. The authenticated request does not by itself establish credential theft or malicious exfiltration.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash

# 1. drop it into the skills directory
mkdir -p ~/.workbuddy/skills
cp -r prospectus-digest-cn ~/.workbuddy/skills/

# 2. ask the agent for the five-section card defined in SKILL.md and save it as my-prospectus-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r prospectus-digest-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的速览卡五段出卡，产物存成我的招股书卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command uses an unversioned npm CLI and a mutable repository reference, creating a supply-chain exposure if either upstream changes or is compromised. Although the scanner incorrectly characterizes the CLI as an MCP server, the reproducibility and installation-integrity weakness is real.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The optional bundle installer invokes an unpinned npm CLI and obtains skill definitions from a mutable repository. A compromised dependency or upstream update could introduce executable installation behavior or adversarial agent instructions; optional installation reduces exposure but does not remove it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

Selecting an individual skill limits installation scope but still leaves both the npm installer and repository content unpinned. Upstream compromise or unexpected changes could therefore affect the local installation and subsequent agent behavior.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The request legitimately authenticates a tools/list call, but sends a bearer credential to a catalog-derived URL without specifying an HTTPS requirement or approved destination check. If the catalog entry or routing variable is manipulated, the key could be sent to an attacker-controlled endpoint; the request body itself contains no prospectus content.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take the domain's routing.url and transport from that response; do not copy the host into a config by hand

3) with a key, send tools/list — proves only that this data-leg endpoint accepts the key, and proves nothing about other entries

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The installation command does not pin either the npm CLI version or the skill repository revision. Although this is an installer rather than an MCP server, mutable upstream dependencies create a genuine supply-chain risk during installation and later skill use.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The bundle-installation example uses an unversioned npm executable and mutable remote skill content. Compromise or unexpected changes in either upstream could introduce unwanted code or agent instructions, even though users can choose which skills to install.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The single-skill option narrows the installed content but does not establish immutable versions for the installer or skill. A compromised upstream could consequently change installation behavior or the instructions the agent subsequently loads.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The connectivity test sends the API key to a routing URL obtained from a remote catalog without requiring destination validation or HTTPS. Authentication is expected for this workflow, but a manipulated catalog entry or routing variable could redirect the credential to an unauthorized recipient.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The document-parsing workflow lacks a privacy warning about sending document content to an external service.

Medium

• Category: Output Handling
• Confidence: 93% confidence

Finding

The workflow sends prospectus material to an external parsing service without explicitly warning about disclosure, retention, or obtaining approval before uploading user-supplied content. Filed prospectuses are generally public, which limits typical harm, but supplied drafts, attachments, or annotations could contain confidential information.

Content

No source excerpt is available for this finding.