Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
代码仅包含两条文档转换命令，没有调用 Cue、获取或分析股票数据，也没有实现筹码分布、均线阻力或量能推演。文档导出可以是分析流程的辅助实现细节，但所提供代码未体现任何相关分析流程，因此其实际主要用途与声明存在实质差异。
- Content
Security audit
解套压力线
Security checks for vulnerabilities and agentic risk
Overview
This stock-analysis skill needs review because it automatically updates code that uses your API key while giving contradictory instructions about access to that key.
Before installing, review and pin the runner version and clarify how the API key will be handled. Keep the key in local configuration rather than pasting it into chat. Stock queries and optional holding costs go to Cue; scheduled runs consume credits and should be enabled only for stocks and times you explicitly choose.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Description-Behavior Mismatch
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
Installing a runner is a disclosed dependency, so repository installation is not inherently a description-behavior mismatch. However, the instructions automatically clone or update an unpinned repository, optionally from a second host, and subsequently execute its Python code; compromised upstream content could therefore execute with the agent's local permissions and access credentials or reports.
- Content
External Script Fetching
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
- Content
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='短线盘面' for b in s.get('buddies',[]) if b.get('title')=='个股短线筹码阻力穿透'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
text | 检查 | 预期 | 异常处理 |
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | 环境 | 配置方式 | |------|---------| | Claude Code | 用 `CronCreate`，cron 表达式 `30 16 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） | | macOS | 建 `~/Library/LaunchAgents/com.cue.unwind-pressure-line.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 16、`Minute` 30，再 `launchctl load` | | Linux | `crontab -e` 追加 `30 16 * * 1-5 <上面的命令>` | 配完必须回报三件事：**触发时间、绑定标的、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | 环境 | 配置方式 | |------|---------| | Claude Code | 用 `CronCreate`，cron 表达式 `30 16 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） | | macOS | 建 `~/Library/LaunchAgents/com.cue.unwind-pressure-line.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 16、`Minute` 30，再 `launchctl load` | | Linux | `crontab -e` 追加 `30 16 * * 1-5 <上面的命令>` | 配完必须回报三件事：**触发时间、绑定标的、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md |------|---------| | Claude Code | 用 `CronCreate`，cron 表达式 `30 16 * * 1-5`（自定义时间按用户所选取 分 时 日 月 周） | | macOS | 建 `~/Library/LaunchAgents/com.cue.unwind-pressure-line.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 16、`Minute` 30，再 `launchctl load` | | Linux | `crontab -e` 追加 `30 16 * * 1-5 <上面的命令>` | 配完必须回报三件事：**触发时间、绑定标的、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 85% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md | macOS | 建 `~/Library/LaunchAgents/com.cue.unwind-pressure-line.plist`，`StartCalendarInterval` 设 `Weekday` 1–5、`Hour` 16、`Minute` 30，再 `launchctl load` | | Linux | `crontab -e` 追加 `30 16 * * 1-5 <上面的命令>` | 配完必须回报三件事：**触发时间、绑定标的、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。 ### 必须提前告知的两个坑
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md | 目标格式 | 依赖 | macOS | Ubuntu | |----------|------|-------|--------| | Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` | | PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` | ---
The health-check command reads the user's API key despite explicit documentation that the agent may not inspect it.
Medium
- Category
- Excessive Agency
- Confidence
- 90% confidence
- Finding
L170 and L220 explicitly state that the agent has no authority to view the user's API key. However, the agent-directed health check at L231 extracts the plaintext key from ~/.cue/config.json (or CUE_API_KEY) into a shell variable, then uses it in requests at L233–L234. This contradicts the documented credential-access boundary, even though the requests target the intended Cue service.
- Content
Static analysis
No suspicious patterns detected.