Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
文档导出可以是基金分析流程的辅助步骤，本身不构成异常能力；但当前提供的代码全部是格式转换命令，没有基金数据获取、经理画像、业绩归因、风险计算或其他分析逻辑。因此，就所提供代码而言，其实际主要用途与声明的基金深度体检存在实质差异。
- Content
Security audit
基金值不值得买
Security checks for vulnerabilities and agentic risk
Overview
This fund-research skill needs review because setup requires sharing a secret API key in chat despite conflicting privacy assurances.
Configure the key locally through a protected configuration file or CUE_API_KEY instead of pasting it into chat, and rotate any key already shared. Expect research queries to reach Cue, and review a fixed runner version before executing externally downloaded code.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The supplied code exclusively manages a skills repository. It does not retrieve fund data, analyze performance or risk, or produce the promised assessment. Repository setup could support a larger workflow, but no such connection or fund-analysis behavior is present in this chunk, making its actual purpose materially different from the description.
- Content
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
Credential loading and calls to Cue are reasonable supporting implementation details and are not independently suspicious. However, the entire supplied chunk stops at configuration, connectivity, and catalog checks. It never invokes the fund-analysis buddy or performs any of the substantive analysis described. Thus, the supplied implementation is a readiness diagnostic rather than the advertised comprehensive fund assessment.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes for b in s.get('buddies',[]) if b.get('title')=='公募基金全维尽调'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
text | 检查 | 预期 | 异常处理 |
The setup instructions require users to disclose their API key in the agent conversation.
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
The setup instructions repeatedly require users to paste an API key into the agent conversation, unnecessarily exposing a credential to conversation retention, logs, and systems with access to the transcript. Although the key serves the legitimate Cue integration, unauthorized access could permit API usage or credit consumption within that key's permissions; stating that the agent cannot view the key does not protect a key pasted into chat.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Static analysis
No suspicious patterns detected.