Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
所提供的代码仅包含 Markdown 转 Word 和 PDF 的命令，未体现 Cue 调用、股票数据处理、资金流分析或估值模型。文档导出可以作为分析流程的辅助步骤，但该代码块没有显示它与任何估值分析流程的关联，其可见的主要用途与声明存在实质差异。
- Content
Security audit
个股估值与股价分析
Security checks for vulnerabilities and agentic risk
Overview
This stock-research skill needs review because it requires a secret API key in chat and forbids canceling active runs.
Configure the key through secure local setup instead of chat, and replace any key already shared. Review and pin the downloaded runner, confirm credit costs, and retain control over cancellation. Research queries and reports are handled by Cue.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The supplied chunk performs only repository setup or maintenance. It contains no stock-data retrieval, capital-flow analysis, valuation modeling, or invocation of an analysis workflow. Repository setup could support the declared purpose in a larger implementation, but the supplied code does not establish that connection or implement the described functionality. It downloads repository content; it does not explicitly execute that downloaded content.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='投资研究' for b in s.get('buddies',[]) if b.get('title')=='个股估值与股价分析'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
text | 检查 | 预期 | 异常处理 |
The setup instructions request an API key in chat without warning about credential exposure.
Medium
- Category
- Output Handling
- Confidence
- 98% confidence
- Finding
The instructions repeatedly require users to paste their API key into the conversation, unnecessarily exposing a credential to chat history, logging, and any integrations with access to the transcript. Although authentication to Cue is legitimate, obtaining the secret through ordinary chat can enable unauthorized API use or consumption of the user's credits if the transcript is disclosed.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Static analysis
No suspicious patterns detected.