Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码仅包含两条文档转换命令，没有读取或分析基金持仓、计算暴露、识别重复配置或评估集中度风险的逻辑。文档导出虽然可能作为分析报告的辅助步骤，但当前提供的代码没有展示与所声明分析功能的联系，因此其实际主要用途与声明存在实质差异。
- Content
Security audit
基金组合持仓穿透分析
Security checks for vulnerabilities and agentic risk
Overview
The fund-analysis workflow is coherent, but its setup exposes API keys through chat while giving contradictory assurances about credential access.
Review the credential setup before installing: configure the key locally instead of pasting it into chat, protect the configuration file, and rotate any key already shared. Portfolio queries go to Cue. Review or pin the downloaded runner, and ensure you can stop tasks when needed.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The supplied code performs repository installation or maintenance rather than portfolio analysis. It contains no holdings processing, exposure analysis, overlap detection, or concentration checks. Although repository setup could support a larger Cue workflow, no connection to the declared analysis is shown here; fetching and updating a skills repository is the chunk's entire behavior. The code does not itself execute the downloaded content.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes for b in s.get('buddies',[]) if b.get('title')=='基金组合穿透与重复配置排雷'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
text | 检查 | 预期 | 异常处理 |
Users are instructed to paste their API key into the agent conversation without a credential-exposure warning.
Medium
- Category
- Output Handling
- Confidence
- 98% confidence
- Finding
The skill repeatedly requires users to paste an API key into the agent conversation, unnecessarily exposing a reusable credential to conversation storage, logging, and anyone with access to those records. Authentication is legitimate for this service, but conversational disclosure is unnecessary and could enable unauthorized API use or consumption of the user's credits; statements that the agent cannot view the key do not prevent this exposure.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Static analysis
No suspicious patterns detected.