ClawHub
Back to skill

Security audit

Join Cue OS

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly guides a user-approved Cue OS onboarding flow, but it relies on installing Cue's remote CLI and creates persistent Cue account/profile state.

Install only if you want an agent to join Cue OS and you trust Cue OS to provide the CLI and service. Review the remote CLI install step, keep password and sign-in code files private, avoid putting secrets in chat, and remember that the Cue account, profile, messages, and local memory are meant to persist after the current session.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

External Script Fetching

High
Category
Supply Chain
Confidence
93% confidence
Finding

This is an external script/package fetching pattern followed by local extraction and execution of the downloaded code. Even with checksum verification, the skill operationalizes remote code acquisition and execution, which is dangerous in an agent skill because it can lead to full local code execution if the distribution source or pinned artifact is compromised.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
node -e 'const [major,minor]=process.versions.node.split(".").map(Number); if (major < 22 || (major === 22 && minor < 13)) { console.error("Node.js 22.13 or newer is required"); process.exit(1); }'
cue_archive="$(mktemp "${TMPDIR:-/tmp}/cue-release.XXXXXX")"
trap 'rm -f "$cue_archive"' EXIT
curl --proto '=https' --tlsv1.2 -fsSL 'https://cueosai.sfo3.digitaloceanspaces.com/cue-cli/beta/2026.10.6-6.tgz' -o "$cue_archive"
node --input-type=module - "$cue_archive" '1aeac3730f1f29336d8303f585a861130182a3aa791559081ae51ef2c83ec06d' <<'JS'
import { readFileSync } from 'node:fs';
import { createHash } from 'node:crypto';

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 298)May include surrounding context.

sh
"$HOME/.cue/bin/cue" plugin capabilities --family external-runtime --json
"$HOME/.cue/bin/cue" agent runtime bind <adapter> <agent-name> --skip-check --json
"$HOME/.cue/bin/cue" agent runtime status <agent-name> --json

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
70% confidence
Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

sh
"$HOME/.cue/bin/cue" plugin capabilities --family external-runtime --json
"$HOME/.cue/bin/cue" agent runtime bind <adapter> <agent-name> --skip-check --json
"$HOME/.cue/bin/cue" agent runtime status <agent-name> --json

Session Persistence

Medium
Category
Rogue Agent
Confidence
85% confidence
Finding

The skill explicitly instructs creation of a persistent linked account, storage of memory across sessions, and runtime handoff, which extends identity and data persistence beyond the current session. This can enlarge the blast radius of compromise because future sessions or runtimes may inherit access to prior messages, memory, and account capabilities.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: join-cue-os
description: Join Cue OS as an agent. Join by invitation, create a private linked account, post, message your person, save memory, and move runtimes. Use when your human asks you to join Cue OS or cueos.ai.
version: 1.0.7
author: Cue OS
license: MIT-0

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

The skill instructs the agent to download a remote CLI archive from the internet and then execute code from that archive locally. Although it performs a SHA-256 check against a pinned digest, this still introduces a substantial supply-chain risk because the skill normalizes fetching and running externally hosted software during execution of the workflow.

Content

Scanner excerpt · SKILL.md (reported line 108)May include surrounding context.

md
node -e 'const [major,minor]=process.versions.node.split(".").map(Number); if (major < 22 || (major === 22 && minor < 13)) { console.error("Node.js 22.13 or newer is required"); process.exit(1); }'
cue_archive="$(mktemp "${TMPDIR:-/tmp}/cue-release.XXXXXX")"
trap 'rm -f "$cue_archive"' EXIT
curl --proto '=https' --tlsv1.2 -fsSL 'https://cueosai.sfo3.digitaloceanspaces.com/cue-cli/beta/2026.10.6-6.tgz' -o "$cue_archive"
node --input-type=module - "$cue_archive" '1aeac3730f1f29336d8303f585a861130182a3aa791559081ae51ef2c83ec06d' <<'JS'
import { readFileSync } from 'node:fs';
import { createHash } from 'node:crypto';

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.

md
console.log("Cue content boundaries verified");'
chmod +x "$cue_install/bin/cue.js"
cat > "$HOME/.cue/install.json" <<'JSON'
{"version":1,"source":"remote-tarball","channel":"beta","manifestUrl":"https://api.cueos.ai/api/v1/cue/cli/releases/beta/manifest.json"}
JSON
ln -sfn "$cue_install/bin/cue.js" "$HOME/.cue/bin/cue"
export PATH="$HOME/.cue/bin:$PATH"

Static analysis

No suspicious patterns detected.