ClawHub
Back to skill

Security audit

自选清单增量日报

Security checks for vulnerabilities and agentic risk

Overview

The stock-report workflow fits its purpose, but its optional connection checks can expose your API key to an unapproved server.

Use the documented local-data workflow without an API key until both authenticated examples enforce approved HTTPS destinations and the helper blocks or revalidates redirects. Review optional companion skills and installer revisions. Online company lookups disclose those interests to the provider. The evidence supports Review for credential-protection gaps, not intentional theft.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
Findings (29)

Tainted flow: 'req' from os.environ.get (line 188, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/cue_connectivity_check.py (reported line 193)May include surrounding context.

python
code = None
    raw = ""
    try:
        with urllib.request.urlopen(req, timeout=args.timeout) as resp:
            code, raw = resp.status, resp.read().decode("utf-8", "replace")
    except urllib.error.HTTPError as err:
        detail = ""

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 96)May include surrounding context.

bash
   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.en.md (reported line 100)May include surrounding context.

md
rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<replace with one of the ids listed by the line above>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 97)May include surrounding context.

bash
   CATALOG="https://cuecue.cn/api/mcp-catalog"
   curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · README.md (reported line 101)May include surrounding context.

md
rows=json.load(sys.stdin)["data"]["domains"]
   [print(r.get("id"), r.get("external_status"), (r.get("routing") or {}).get("url", "-")) for r in rows]'
   DOMAIN_ID="<把这里换成上一行列出的那个域 id>"
   ROUTING_URL="$(curl -s "$CATALOG" | python3 -c 'import json,sys
   rows=json.load(sys.stdin)["data"]["domains"]
   hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
96% confidence
Finding

The supplied chunk implements a standalone connection diagnostic, not the declared watchlist-digest workflow. Connectivity checks could support that workflow, but this script operates on arbitrary catalog domains and never connects its behavior to watchlist state or report generation. Its HTTPS and host-suffix checks constrain the initial credential-bearing request, and authenticated requests require --post; those safeguards do not resolve the purpose mismatch. The code does not establish malicious intent.

Content

No source excerpt is available for this finding.

Incomplete referenced artifact analysis

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

md
通道怎么开：三层（注册 → 取 api-key → 装 skill 后还要实连才算连上）写在 `README.md` §三 末小节，那一格给一条可执行的安装命令（本件 `npx skills add huhoo/cue-awesome --skill watchlist-digest-cn`；取证腿整套与单装两种写法）

The credential-target guarantee does not cover HTTP redirects.

High
Category
Excessive Agency
Confidence
99% confidence
Finding

The destination guard checks only the initial URL, but urllib.request.urlopen follows redirects using its default handler. For redirects such as 301, 302, and 303, a POST can become a GET while retaining the Authorization header, allowing an authorized endpoint with an open redirect or compromised routing behavior to disclose the API key to an unauthorized host or an HTTP destination. This violates the script's credential-destination guarantee even though the initial authenticated request requires explicit consent.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
70% confidence
Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The installation command executes the unpinned npm package skills through npx and installs skill content from a mutable repository reference. Although this is an installation CLI rather than an MCP server, a compromised or unexpectedly changed dependency could execute code or introduce adversarial agent instructions with the user's privileges.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.en.md (reported line 43)May include surrounding context.

bash
# 1. Put it in the skills directory (either route; afterwards list installed skills again and seeing watchlist-digest-cn there is what proves the files landed)
npx skills add huhoo/cue-awesome --skill watchlist-digest-cn
mkdir -p ~/.workbuddy/skills
cp -r watchlist-digest-cn ~/.workbuddy/skills/

# 2. Settle the list -> run the increment -> pass the gate (section 1)

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The whole-collection installation uses an unpinned npx CLI and a mutable skill repository. This creates a supply-chain exposure during optional setup; describing the collection as official does not establish the integrity of the version actually installed.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The individual-skill commands also run an unpinned npm CLI and retrieve skills without immutable revision constraints. Selecting one skill reduces the installed scope but does not prevent a compromised CLI or changed upstream skill from affecting the local agent environment.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This repeats the unpinned installation command, so it shares the same supply-chain weakness rather than introducing a separate exploit mechanism. Checking that a skill appears in the installed list proves presence, not the integrity or safety of its contents.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
98% confidence
Finding

The shell example sends the bearer credential to a URL taken directly from catalog data without checking its scheme or authorized host. A compromised or misconfigured catalog could direct the key to an attacker-controlled endpoint or an HTTP endpoint; the gates described for the separate connectivity script do not protect this curl command.

Content

Scanner excerpt · README.en.md (reported line 105)May include surrounding context.

md
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("Not found: that id is not in the catalog response (or its routing has no url field) - run the line above and pick one of the ids listed")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "Fetch failed: ROUTING_URL is empty - run the line above, then set DOMAIN_ID to one of the ids listed" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The installation command invokes an unpinned npm CLI through npx and installs skill content from a mutable repository reference. Although this is not itself an MCP server declaration, it creates a supply-chain risk: compromised upstream releases or repository changes could introduce executable code or adversarial agent instructions.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 43)May include surrounding context.

bash
# 1. 放到技能目录（两条路任选，装完重列一次已安装 skill 看得到 watchlist-digest-cn 才算文件到位）
npx skills add huhoo/cue-awesome --skill watchlist-digest-cn
mkdir -p ~/.workbuddy/skills
cp -r watchlist-digest-cn ~/.workbuddy/skills/

# 2. 落清单 → 跑增量 → 过机检（三步见 §一）

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The collection-install command leaves both the npx-executed CLI and the upstream skill collection unpinned. Selecting skills interactively limits what is installed but does not establish the integrity of the installer or selected skill instructions.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Selecting a named skill does not pin its contents or the npx installer. A compromised upstream release or repository update could therefore change the code and instructions installed by this otherwise legitimate setup command.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This repeats the mutable installation command identified at line 42, rather than introducing a separate attack mechanism. Reusing it still permits upstream changes to determine which installer code and agent skill content are installed.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
99% confidence
Finding

The shell example sends CUE_API_KEY to a URL taken directly from catalog data without validating its scheme or destination host. If that routing entry is compromised or misconfigured, the key can be sent to an attacker-controlled endpoint or over plaintext HTTP; the destination checks described for the separate Python helper do not protect this curl command.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

md
hit=[r["routing"]["url"] for r in rows if r.get("id")==sys.argv[1] and r.get("routing")]
   print(*hit,sep="\n") if hit else sys.exit("未取到：该 id 不在目录现值里（或它没有 routing 里的 url 字段）——先跑上面那行列出现场的 id 再填")' "$DOMAIN_ID")"
   [ -n "$ROUTING_URL" ] || { echo "取值失败：ROUTING_URL 为空——先跑上面那行列出现场 id，再把 DOMAIN_ID 换成其中之一" >&2; exit 1; }
   curl -s -X POST "$ROUTING_URL" \
     -H "Authorization: Bearer $CUE_API_KEY" \
     -H "Accept: application/json, text/event-stream" \
     -d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}' \

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, network, shell.

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

The external lookup workflow lacks a privacy warning that queries can reveal the user's watchlist interests.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

External company-specific lookups can reveal the user's watchlist interests to the data provider, potentially linked to an authenticated account through the API credential. External retrieval is clearly part of the skill's purpose, which reduces the surprise, but the documentation does not explain this privacy consequence or distinguish local watchlist storage from remote query disclosure.

Content

No source excerpt is available for this finding.

MCP server referenced without pinned version: 'npx skills'.

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The documented installation command uses an unpinned npx package and an unpinned skill repository, allowing installation behavior to change without review. If either upstream is compromised, an agent following this optional setup path could execute attacker-controlled code or install malicious instructions with its available privileges; this is an installer supply-chain issue, not evidence of an unversioned MCP server.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.