行业景气全景-cn

• Outcome: Review
• Latest audit: Oct 23, 2026 · 12:27 AM UTC
• Version: 0.1.30

Overview

This industry-report skill needs review because its connection checks can expose your API key to an unapproved destination.

Use the documented user-supplied-material path without an API key until credential handling is fixed. Before enabling Cue authentication, require validated HTTPS destinations and redirect handling that cannot forward the key elsewhere. Review fixed installer and repository versions before running installation commands. No intentional theft or destructive behavior was established.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python

code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 47)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 51)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with one of the ids listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 51)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 55)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The supplied chunk has a materially different primary purpose: service discovery and connectivity verification. It does not process an industry and time window, generate analytical dimensions, retrieve comparable industry series, or produce the promised report. Although connectivity diagnostics could support a larger research workflow, no such integration is demonstrated here, and the declared description does not disclose this standalone credential-bearing service diagnostic. Credential use requires --post and an HTTPS/authorized-host check, so the code does not demonstrate unconditional credential disclosure or malicious intent; those safeguards do not resolve the description–behavior mismatch.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The supplied chunk implements an MCP connectivity and discovery workflow. It does not accept an industry or time window, generate analytical dimensions, retrieve comparable industry series, or construct the promised report. Service discovery could support a research implementation, but this chunk exposes arbitrary catalog-selected routing and authenticated tool enumeration without any visible connection to the declared reporting workflow. The credential transmission is explicit; the snippet does not establish malicious intent or additional data exfiltration.

Content

No source excerpt is available for this finding.

Automatic redirects can bypass the documented credential-destination restrictions.

High

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The destination guard checks only the initial URL, while urllib.request.urlopen automatically follows supported redirects and can preserve the explicitly supplied Authorization header when constructing the redirected request. An allowed endpoint that is compromised or exposes an attacker-controllable redirect could therefore send the API key to an unauthorized host or an HTTP destination, bypassing both documented restrictions. Explicit --post opt-in reduces exposure but does not authorize these subsequent destinations.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command invokes an unpinned npm CLI through npx and installs skill content from a repository without an immutable revision. Although this is an installer rather than an MCP server, compromised or unexpectedly changed upstream releases could execute code locally or introduce adversarial agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The collection-wide installation command leaves both the npx installer version and the upstream skill revision unspecified. Installing evidence-gathering integrations this way creates a supply-chain exposure in a workflow that subsequently uses credentials and external services; the reference to an official collection does not establish integrity.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The single-skill installation example also uses an unpinned npx CLI and mutable repository content. Selecting cue-data-mcp limits installation scope but does not prevent an upstream compromise or update from changing code or agent instructions installed locally.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

Authenticated connectivity testing is legitimate, but this shell example sends CUE_API_KEY to a URL taken directly from an anonymous catalog without validating its scheme or authorized destination. A compromised or malicious catalog entry could direct the bearer token to an attacker or an HTTP endpoint; the destination gates described for the separate Python helper do not protect this curl command.

Content

Scanner excerpt · README.en.md (reported line 56)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

Although this command installs a skill rather than directly referencing an MCP server, it executes an unpinned npm CLI through npx skills and installs repository content without an immutable revision. A compromised or unexpectedly changed upstream release could execute code with the user's privileges or introduce malicious agent instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The collection installation command uses an unpinned executable npm package and mutable remote skill content. Installing additional data-access skills expands the trust boundary, so upstream compromise could affect both local execution and agents subsequently using those skills.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The single-skill installation variant still executes the unpinned skills CLI and does not pin the selected skill's repository revision. Selecting one skill reduces installation scope but does not eliminate the supply-chain exposure.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

The shell example sends CUE_API_KEY to a URL taken directly from the remote catalog without checking its scheme or authorized hostname. Authentication to the intended service is legitimate, but a compromised or misconfigured catalog could direct the bearer token to an attacker-controlled HTTPS endpoint or an unencrypted HTTP endpoint; the separately described guarded Python helper does not protect this shell example.

Content

Scanner excerpt · README.md (reported line 60)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, network.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The documented no-network default still performs an outbound catalog request.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Without --catalog-file, execution fetches the catalog before checking --list, --domain, or --post, despite repeated claims that the default sends no packets. This unexpected anonymous request reveals connection metadata and may violate offline or restricted-network expectations, although it does not include CUE_API_KEY. Other documentation explicitly describes the catalog GET, making this an inconsistent safety guarantee rather than evidence of covert credential exfiltration.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.