盘后超级助理

• Outcome: Review
• Latest audit: Oct 23, 2026 · 5:15 AM UTC
• Version: 1.0.12

Overview

This market-report skill needs review because its downloaded runner recommends disabling agent protections to fix connection errors.

Review and pin the downloaded runner before use. Keep sandbox protections enabled and permit only the network access needed for Cue. Your queries go to Cue, and optional recurring reports consume credits; enable scheduling only if you want that ongoing usage.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence

Finding

Runner installation is explicitly disclosed and supports report generation, so the claimed description-behavior mismatch is not substantiated. However, the installation/update flow retrieves an unpinned repository from GitHub or Gitee and subsequently executes its Python code without integrity verification or review; compromised upstream content could execute with the user's permissions and access local credentials.

Content

No source excerpt is available for this finding.

External Script Fetching

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 345)May include surrounding context.

CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='财富投顾' for b in s.get('buddies',[]) if b.get('title')=='盘后超级助理'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"

text

| 检查 | 预期 | 异常处理 |

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

| 环境 | 配置方式 |
|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `10 17 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.after-market.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 17、`Minute` 10，再 `launchctl load` |
| Linux | `crontab -e` 追加 `10 17 * * 1-5 <上面的命令>` |

配完必须回报三件事：**触发时间、输出目录、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 182)May include surrounding context.

md

| 环境 | 配置方式 |
|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `10 17 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.after-market.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 17、`Minute` 10，再 `launchctl load` |
| Linux | `crontab -e` 追加 `10 17 * * 1-5 <上面的命令>` |

配完必须回报三件事：**触发时间、输出目录、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 183)May include surrounding context.

md

|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `10 17 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.after-market.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 17、`Minute` 10，再 `launchctl load` |
| Linux | `crontab -e` 追加 `10 17 * * 1-5 <上面的命令>` |

配完必须回报三件事：**触发时间、输出目录、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 185)May include surrounding context.

md

| macOS | 建 `~/Library/LaunchAgents/com.cue.after-market.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 17、`Minute` 10，再 `launchctl load` |
| Linux | `crontab -e` 追加 `10 17 * * 1-5 <上面的命令>` |

配完必须回报三件事：**触发时间、输出目录、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。

### 必须提前告知的两个坑

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 261)May include surrounding context.

md

| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

## 可视化看板（输出增强）

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 262)May include surrounding context.

md

| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

## 可视化看板（输出增强）

The health-check command reads the API key despite documentation prohibiting the agent from viewing it.

Medium

• Category: Excessive Agency
• Confidence: 88% confidence

Finding

L215 and L331 explicitly state that the agent has no authority to view the user's API key. However, the agent-executed health check at L342 opens ~/.cue/config.json, extracts api_key (or reads CUE_API_KEY), and places the secret in a shell variable for subsequent requests. Although it does not display the key to the user, this directly retrieves the credential rather than merely checking whether it is configured.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.