公司一页纸

• Outcome: Review
• Latest audit: Nov 5, 2026 · 2:37 PM UTC
• Version: 0.1.21

Overview

Review before enabling: the connection example sends your API key to an unchecked destination, and the document checker misses several promised safeguards.

Use user-supplied disclosures until the connection example restricts credential transmission to an approved HTTPS destination. Review the exact installer and skill revision before installation. Manually verify citations, risk cautions, and empty opinion slots because the checker can pass documents that violate those requirements. Companion Cue skills and live services were not inspected, so their permissions and behavior remain outside this assessment.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 50)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 54)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<replace with a domain id listed by the line above>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 50)May include surrounding context.

bash

CATALOG="https://cuecue.cn/api/mcp-catalog"
curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 54)May include surrounding context.

md

rows=json.load(sys.stdin)["data"]["domains"]
[print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
rows=json.load(sys.stdin)["data"]["domains"]
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

该代码块的实际用途是远程 MCP 服务发现与带认证的工具枚举，没有公司输入、财务或披露信息处理，也没有生成所声明的五段速览。工具发现可能成为其他流程的基础设施，但此处未显示其与公司速览任务存在关联，且会向动态选出的路由发送 API 凭证，因此不能仅视为已声明任务的明确支持性实现细节。代码没有调用列出的工具，也未显示读取本地文件或传输公司数据。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

这段代码的实际功能是发现 MCP 服务并枚举工具，而不是获取或整理公司披露、计算近四期指标、筛选事件或形成规定格式的速览。工具发现本可作为支持性实现细节，但此处没有展示任何公司任务绑定或后续业务处理，且会将认证凭据发送到动态取得的地址。因此，就所提供代码而言，其主要行为与声明用途存在实质偏差。代码并未显示读取具体公司资料、生成投资建议或主动开展深研；也不能仅凭该片段断定动态路由地址具有恶意。

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

Although this is a skill installer rather than an MCP server, the recommended npx command can fetch and execute an unpinned npm package, and the skill repository reference is also mutable. A compromised or unexpectedly changed upstream release could execute code or install adversarial agent instructions during setup.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

Authenticated tools/list discovery is legitimate for this skill, but the command sends CUE_API_KEY to a routing URL taken verbatim from remote JSON without checking its scheme or destination. If the catalog or its routing records are compromised or misconfigured, the key could be sent to an attacker-controlled host or over plaintext HTTP; HTTPS protection of the catalog does not constrain the returned destination.

Content

Scanner excerpt · README.en.md (reported line 59)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("not found: that id is not in the live catalog (or it has no routing.url) - run the listing line first, then fill it in")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "no value: ROUTING_URL is empty - list the ids first, then set DOMAIN_ID to one of them" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium

• Category: MCP Rug Pull
• Confidence: 94% confidence

Finding

The installation command invokes an unpinned npm CLI and references a mutable skill repository, although the detector incorrectly labels it an MCP server. Following these instructions could execute a compromised upstream package or install changed agent instructions without a reproducible reviewed version.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 97% confidence

Finding

The command attaches CUE_API_KEY to a destination supplied by the remote catalog without validating the destination's origin or requiring HTTPS. Discovery is expected functionality, but a compromised or erroneous routing record could redirect this explicit credential transmission to an attacker or a plaintext endpoint.

Content

Scanner excerpt · README.md (reported line 59)May include surrounding context.

md

hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
[ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
curl -s -X POST "$ROUTING_URL" \
  -H "Authorization: Bearer $CUE_API_KEY" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: file_read.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The human-only opinion check accepts authored opinions appended to placeholder markers.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Placeholder validation checks only the prefix - [待人工], allowing generated opinions to be appended to three placeholder lines without failing the human-only opinion check. This undermines an explicit human-review boundary in a financial briefing; the separate banned-word scan does not catch every substantive opinion.

Content

No source excerpt is available for this finding.

A negative risk-search statement is treated as a positive hit, bypassing the mandatory disclaimer.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

The risk-hit test treats any occurrence of 命中 as a positive hit, so a negative statement such as 未命中 suppresses the mandatory disclaimer. In this financial-summary context, that permits a passing document to omit the warning that an unsuccessful search does not establish absence of exposure.

Content

No source excerpt is available for this finding.

Appendix-only citations satisfy reconciliation despite documentation explicitly excluding appendix prose.

Medium

• Category: Excessive Agency
• Confidence: 99% confidence

Finding

Citation reconciliation extracts source IDs from the entire document, including appendix prose, despite the stated requirement that appendix prose not count. An author can therefore park citations in an appendix to make unused source records appear reconciled, weakening the evidence audit for the financial briefing without actually linking those records to eligible body content.

Content

No source excerpt is available for this finding.