关联交易条款速读

• Outcome: Review
• Latest audit: Nov 12, 2026 · 1:53 PM UTC
• Version: 0.1.1

Overview

The scanners report undeclared external service discovery, credential and document handling risks, and an extraction-validation flaw, so this skill is marked suspicious for review.

Treat this as a review item before installing. Consider whether the external catalog and parsing services are expected, whether you are comfortable sending an API key or documents to their configured destinations, and whether the installer and source can be pinned and reviewed. The scanner also reports a possible validation flaw that could treat unresolved figures as complete. Skillspector scanned all listed components, but its analysis was marked partial because a referenced local path was missing; the separate AIG scan completed with no findings, so the overall evidence is not conclusive.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (17)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied shell commands perform remote service discovery and authenticated tool enumeration, not analysis of transaction disclosures. Nothing in the chunk connects those network operations to the declared extraction workflow, so they cannot be established as supporting implementation details. The authenticated request also transmits CUE_API_KEY to the configured endpoint, a resource interaction absent from the declared purpose. The chunk does not demonstrate invoking any discovered tools or processing transaction documents.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk performs connectivity checks and MCP tool discovery, not transaction-document analysis. It contains no document ingestion, eight-card extraction, source anchoring, or missing-information handling. Network access could support a document-analysis implementation, but this chunk establishes no connection between these external service checks and the declared purpose. The mismatch concerns the observed service-discovery behavior; the code does not establish malicious intent or downstream tool execution.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash

# 1. drop the skill into your skills directory
mkdir -p ~/.workbuddy/skills
cp -r related-party-terms-cn ~/.workbuddy/skills/

# 2. ask the agent for the five-section card defined in SKILL.md, save it as my-related-party-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 29)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r related-party-terms-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的条款卡五段出卡，产物存成我的关联交易条款卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command runs an unpinned npm CLI and installs skill content from an unpinned repository. Although this is not itself an MCP server reference, a compromised future release or repository revision could introduce code or agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The optional collection installer executes an unpinned npm CLI and retrieves mutable third-party skills. User selection limits which skills are installed, but does not protect against compromised installer releases or selected skill revisions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Selecting a single skill reduces installation scope but leaves both the npm installer and repository content unpinned. A compromised upstream update could therefore alter the installed retrieval or document-parsing workflow.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The tools/list request is legitimate authentication, not evidence of malicious exfiltration, but it sends the API key to a catalog-provided URL without a stated destination or HTTPS validation step. If the catalog or routing value is compromised, the workflow could disclose the bearer credential to an attacker-controlled endpoint.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take routing.url and transport for the domain from the response; never hard-code the host

3) with the key, send tools/list - proves that endpoint accepted the key, nothing else

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The command executes an unpinned npm installer and installs this skill from a mutable repository reference. The detector's MCP-server description is imprecise, but the underlying supply-chain exposure is real if an upstream release or revision is compromised.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The collection installation uses an unpinned npm CLI and unpinned third-party skill sources. Interactive selection does not prevent a compromised installer or selected skill update from introducing unsafe code or instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The single-skill command narrows scope but still resolves mutable installer and repository versions. An upstream compromise could affect the installed data-access or attachment-parsing skill and its subsequent handling of credentials or documents.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

The request intentionally authenticates to a service, but its destination is taken from catalog routing without an explicit trusted-origin or HTTPS check. A compromised routing response could cause the bearer API key to be sent to an attacker-controlled host; the tools/list payload itself contains no user document.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The attachment-parsing workflow lacks a warning about third-party processing of user documents.

Medium

• Category: Output Handling
• Confidence: 87% confidence

Finding

The attachment workflow recommends an external parsing service without explicitly disclosing that document content may leave the user's environment or requiring approval before transmission. Most intended filings are public, which reduces exposure, but user-provided agreements or annotated attachments may contain confidential information.

Content

No source excerpt is available for this finding.

The attachment-parsing workflow lacks a warning that document content may be sent to an external service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The skill directs attachments to a server-backed parsing channel when needed, but does not explicitly warn that document content may be transmitted externally or require approval for sensitive inputs. Public-disclosure use and conditional parsing reduce the risk, but do not protect confidential user-supplied agreements or annotations.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

附件解析流程缺少向第三方传输用户文档的隐私提示。

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The workflow can send document attachments to an external parsing service without explicitly requiring a privacy notice or informed approval before transmission. Most intended inputs are public disclosures, which reduces exposure, but user-supplied agreements or drafts may contain confidential information; having an API key does not establish permission to upload those documents.

Content

No source excerpt is available for this finding.

Numeric elements are accepted despite the documented requirement to reject values qualified as undetermined or subject to later agreement.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The numeric-element paths in value_gap() populate satisfied without checking whether the candidate’s clause contains VAGUE qualifiers; vague language only affects the diagnostic after an element is already found missing. Consequently, text such as “交易金额 8,600 万元（待定），预计年度额度 12,000 万元（另行约定）” can satisfy both numeric requirements despite explicitly leaving those values unresolved. In this financial-disclosure skill, that bypass can present provisional figures as complete extracted terms and avoid the intended missing-data/manual-review workflow, although it does not enable code execution or data exfiltration.

Content

No source excerpt is available for this finding.