路演纪要

• Outcome: Pass
• Latest audit: Nov 3, 2026 · 1:13 AM UTC
• Version: 0.1.1

Overview

The skill coherently summarizes meeting minutes, with disclosed optional online services that warrant normal document-privacy and credential precautions.

You can use supplied text without enabling Cue integrations. Before sending confidential attachments to Cue, confirm that external processing and its retention terms are acceptable, and verify the HTTPS recipient before supplying a key. Prefer reviewed installation revisions and separately review optional companion skills; their implementation and remote service behavior were not assessed here.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Output Handling: Unvalidated Output Injection, Cross-Context Output, Unbounded Output
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (17)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The supplied chunk performs network discovery and MCP connectivity checks, not meeting-minutes analysis. It contains no document ingestion, verbatim extraction, source anchoring, eight-card generation, or required caveat handling. Although remote calls could support a document-processing workflow, this chunk shows no connection between the queried services and the declared task; its demonstrated purpose is testing access to an MCP service.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

所提供代码执行的是 MCP 目录读取和带密钥的工具列表请求，没有读取或分析纪要，也没有生成声明中的八项输出。声明未提及 MCP 服务发现、认证或工具枚举，代码中也未显示这些网络操作与纪要处理存在支持关系，因此构成实质性的用途与能力不匹配。该片段仅枚举工具，并未显示调用这些工具或上传纪要内容。

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 29)May include surrounding context.

bash

# 1. drop it into the skills directory
mkdir -p ~/.workbuddy/skills
cp -r roadshow-minutes-cn ~/.workbuddy/skills/

# 2. ask the agent for the five-section card defined in SKILL.md and save it as my-minutes-card.md

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 28)May include surrounding context.

bash

# 1. 放到技能目录
mkdir -p ~/.workbuddy/skills
cp -r roadshow-minutes-cn ~/.workbuddy/skills/

# 2. 让 agent 按 SKILL.md 的纪要卡五段出卡，产物存成我的纪要卡.md

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command leaves both the npm-executed skills installer and the fetched skill revision unpinned. Although this is not itself an MCP server declaration, compromised upstream releases could execute installer code or introduce malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The whole-set installation command executes an unpinned npm installer and retrieves skills from a mutable repository revision. A compromised upstream release could execute code or supply malicious skills, and installing a broader collection increases the material requiring review.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Selecting an individual skill limits scope but does not pin either the executable installer or the fetched repository content. Upstream compromise could therefore introduce executable code or malicious instructions into an agent handling documents and credentials.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

Authenticated tools/list discovery is legitimate, but the example sends the API key to a catalog-derived routing URL without an explicit HTTPS or recipient trust check. A compromised catalog or incorrect routing value could direct the bearer credential to an unauthorized endpoint; the supplied text does not establish that such compromise has occurred.

Content

Scanner excerpt · README.en.md (reported line 60)May include surrounding context.

2) take the domain's routing.url and transport from that response; do not copy the host into a config by hand

3) with a key, send tools/list — proves only that this data-leg endpoint accepts the key, and proves nothing about other entries

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The parsing workflow lacks a warning that user-supplied minutes and attachments are processed by a third-party service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The recovery workflow recommends external parsing of minutes and attachments without explicitly warning about document transmission or requiring informed approval. Investor-relations material can include confidential notes or personal information; optional parsing reduces exposure but does not establish consent to disclose it.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The installation command does not pin the npm-executed installer or the skill repository revision. Although the detector describes an MCP server, the actual concern is supply-chain exposure: compromised upstream content could execute code or install malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The collection installation command relies on mutable installer and repository content. Upstream compromise could introduce executable code or malicious skills, and collection-wide installation increases the review surface.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The single-skill selector narrows installation but leaves the installer executable and fetched skill revision unpinned. A compromised upstream update could introduce code or instructions into a workflow that handles documents and API access.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The connectivity test sends a bearer API key to a URL selected from live catalog routing without documenting recipient or HTTPS validation. Discovery itself is expected, but compromised or incorrect routing could cause credential disclosure to an unauthorized endpoint.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

2) 域路由现值：从返回里取该域的 routing.url 与 transport，别把域名抄死

3) 带 key 实连后发 tools/list——只证该数据腿端点被接受，不证别的入口

curl -s -X POST "$ROUTING_URL" -H "Authorization: Bearer $CUE_API_KEY"
-H "Content-Type: application/json" -H "Accept: application/json, text/event-stream"
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' | head -c 400

text

The workflow instructs use of an external parsing service without warning that supplied minutes or attachments may be transmitted to that service.

Medium

• Category: Output Handling
• Confidence: 90% confidence

Finding

The troubleshooting workflow recommends the external parsing channel without explicitly disclosing that minutes or attachments may leave the local environment. These documents may contain confidential or personal information, and the claim that the skill does not persist minutes does not establish the external provider's retention behavior.

Content

No source excerpt is available for this finding.

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read, file_write.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The workflow routes minutes and attachments to an external parsing service without warning that user-provided content will leave the local environment.

Medium

• Category: Output Handling
• Confidence: 94% confidence

Finding

The workflow directs attachment and transcript content to a remote parsing channel without requiring an explicit content-transfer notice or user authorization before submission. Although remote services are documented and parsing is conditional, user-provided research notes or transcripts may contain confidential business information or personal data, making undisclosed third-party processing a meaningful confidentiality risk.

Content

No source excerpt is available for this finding.

The output contract mandates Chinese-language labels and status messages without offering a language choice.

Low

• Category: Output Handling
• Confidence: 90% confidence

Finding

The required output formats prescribe Chinese text such as 共八项·缺 N 项, 未检索到, and [待人工], including complete Chinese missing-item messages. Although this is the English companion document, it offers no user opt-in or locale choice for these required outputs and gives no justification for requiring Chinese.

Content

No source excerpt is available for this finding.