ClawHub
Back to skill

Security audit

股权激励查询

Security checks for vulnerabilities and agentic risk

Overview

This research skill needs review because its privacy confirmation comes after transmission and its credential-storage instructions contradict its safety guidance.

Use public or locally sanitized questions: Cue receives the original text before its redaction confirmation. Review the runner version and MCP configuration changes before installation, and protect the stored API key with restricted permissions or supported secret storage.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 437)May include surrounding context.

CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='资本运作' for b in s.get('buddies',[]) if b.get('title')=='股权激励查询'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"

text

| 检查 | 预期 | 异常处理 |

MCP setup persists the API key despite documentation restricting key use to runtime requests.

Medium
Category
Excessive Agency
Confidence
97% confidence
Finding

The setup directs the agent to copy the real bearer token into persistent client configuration despite subsequently restricting key use to runtime requests. This expands credential exposure to additional files, backups, configuration-sharing workflows, and potentially project repositories, without specifying permissions or secret-storage safeguards.

Content

No source excerpt is available for this finding.

The skill exposes wealth-management prospect discovery beyond its stated equity-incentive analysis purpose.

Medium
Category
Excessive Agency
Confidence
94% confidence
Finding

L283 explicitly describes identifying recently awarded high-net-worth individuals for wealth-adviser customer acquisition, with market-value and regional filters. This is a personal sales-prospecting capability, rather than querying or evaluating listed-company incentive plans and buybacks as described in the manifest.

Content

No source excerpt is available for this finding.

The workflow sends the user's original question to a remote rewrite API before warning about unredacted data transmission or obtaining confirmation.

Medium
Category
Output Handling
Confidence
96% confidence
Finding

The workflow sends the original user question to the remote rewrite service before presenting its privacy-masking result or requesting confirmation. Questions about planned incentive arrangements can contain confidential business details or personal information, so server-side redaction and subsequent confirmation occur too late to prevent the initial disclosure.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 405)May include surrounding context.

md
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 406)May include surrounding context.

md
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Static analysis

No suspicious patterns detected.