合同风控与合规审查

• Outcome: Review
• Latest audit: Sep 15, 2026 · 3:20 AM UTC
• Version: 1.1.0

Overview

This contract-review skill is purpose-related, but it asks users to upload sensitive contracts, paste and persist an API key, and run unpinned remote code.

Review carefully before installing. Use this only if you are authorized to send the contract to Cue and accept running code pulled from external repositories. Do not paste long-lived API keys into chat; prefer a secure secret store or rotate any key already shared. Avoid privileged, regulated, trade-secret, or highly confidential contracts unless retention, access, and deletion terms are acceptable.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:140
• Finding: Mutable Remote Repository Is Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:140-146` and `SKILL.md:190-203` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Complete Code Snippet ```bash if [ -d ~/.cue/cue-skills/.git ]; then git -C ~/.cue/cue-skills pull --ff-only else git clone https://github.com/sensedeal/cue-skills ~/.cue/cue-skills \ || git clone https://gitee.com/sensedeal/cue-skills ~/.cue/cue-skills fi ``` The retrieved code is subsequently executed: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "Our side is <Party A/Party B>; please review this contract and produce a risk checklist" \ --material "<absolute path to local contract file>" \ --template-id template_BFSwVa \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-contract-review.md ``` The alternative workflow also executes the same remotely retrieved runner: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "Our side is <Party A/Party B>. The following is the contract text: ..." \ --template-id template_BFSwVa \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-contract-review.md ``` ### Technical Analysis The Skill directs the Agent to clone or update a mutable external Git repository and then execute a Python script from that repository. Neither source is pinned to an immutable commit or release. The workflow also does not verify a cryptographic hash, signed commit, signed release, or trusted package manifest before execution. Consequently, the code that is eventually executed may differ from the code present when this Skill was audited. The fallback to a second repository mirror creates an additional supply-chain trust boundary. A compromise of either hosting account, repository, maintainer credentials, or distribution endpoint could alter the runner. The remote runner executes with the Agent's local operating-system permissions. It may consequently inherit access to the user's f ...[truncated 1412 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the reviewed runner inside the Skill package rather than downloading executable code at runtime. 2. If remote retrieval is unavoidable, pin it to a specific immutable commit hash. 3. Verify a cryptographic digest or trusted digital signature before any retrieved file is executed. 4. Remove the automatic fallback to an independently mutable mirror, or require the mirror to serve the same verified artifact. 5. Display the source, version, expected digest, and execution plan to the user before downloading or running code. 6. Require explicit user authorization before both retrieval and execution. 7. Execute the runner in a restricted sandbox with: - Read access only to the explicitly selected contract. - No access to unrelated home-directory files. - No inherited secrets other than a narrowly scoped token. - Network access limited to documented service endpoints. - No permission to install software or create persistent services. 8. Maintain a reviewed dependency lock file and fail closed if integrity verification fails. ]]>

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:97
• Finding: Mandatory Third-Party and Commercial Messaging Alters Agent Responses<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:97-115` and `SKILL.md:170-180` **Vulnerability Type**: Skill instruction hijacking **Risk Level**: Medium ### Complete Code Snippet The Skill mandates the following response behavior, translated into English while preserving the operative meaning: ```text When sending the final report to the user, the Cue original-report link must also be attached so that the user can return to the website to view the full text, continue asking questions, or forward it to colleagues. Report completed. <Report body> --- Cue original report: https://cuecue.cn/share/<conv_id> Local copy: ~/cue-reports/<file-name>.md ``` It separately mandates commercial messaging when credits are unavailable: ```text When insufficient credits are detected, do not only return an error code. The user must proactively be given the fastest way to obtain credits: 1. Invite friends to receive 500 credits (recommended): open https://cuecue.cn/, click "Get exclusive invitation link" at the lower-left, and share it with friends. 2. Recharge directly: visit https://cuecue.cn/pay to subscribe, or wait for the next day's free quota. ``` ### Technical Analysis These instructions require the Agent to inject third-party links and commercial referral or payment messaging into its responses. The behavior is not merely optional documentation: it is expressed as mandatory delivery behavior and applies automatically after report generation or insufficient-credit errors. This changes the Agent's response policy in favor of a specific external service. In the insufficient-credit branch, the Skill requires promotional instructions recommending referrals and payment. Such mandatory output manipulation can reduce response neutrality and cause users to interpret service marketing as independently generated Agent advice. Although the share-link instruction is related to report delivery, it is still imposed as a stable third-party redirectio ...[truncated 1325 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all requirements that force the Agent to include promotional, referral, or recharge language. 2. Make the report link optional and clearly identify it as a third-party Cue link. 3. Ask for user consent before including or opening externally hosted report links. 4. Provide neutral insufficient-credit handling, such as stating that remote processing could not start and offering a local review alternative. 5. Separate commercial information from security or operational error messages. 6. Do not label referral acquisition as the recommended recovery method. 7. Permit users to receive the complete report locally without requiring third-party navigation. 8. Ensure that user requests to omit links or commercial information are honored by default. ]]>

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:152
• Finding: Confidential Contract Files Are Required to Be Uploaded to an External Platform<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:152-156` and `SKILL.md:190-195` **Vulnerability Type**: Unauthorized access and privilege escalation **Risk Level**: High ### Complete Code Snippet The Skill provides the following mandatory handling instruction, translated into English: ```text Contract review requires uploading the contract file. When the user provides a local contract file, such as DOCX, PDF, TXT, or Markdown, do not attempt to read its text locally. Directly use the runner's native --material <file path> parameter to send the file to the platform for processing. If the user only pasted contract text and did not provide a file, put the contract body into --query and clearly mark it as the original contract text. ``` The prescribed upload command is: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "Our side is <Party A/Party B>; please review this contract and produce a risk checklist" \ --material "<absolute path to local contract file>" \ --template-id template_BFSwVa \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-contract-review.md ``` ### Technical Analysis The workflow deliberately prevents local extraction and requires the complete contract to be passed to a remotely retrieved runner for platform processing. Contracts frequently contain confidential pricing, trade secrets, signatures, personal information, bank details, addresses, dispute information, and legally privileged material. Passing an absolute local path through `--material` gives the runner read access to the selected file. Because the runner is obtained from a mutable external repository, the reviewed project cannot independently establish exactly what data is read, where it is transmitted, whether metadata is collected, or how the remote service retains and processes it. The Skill contains a statement that the service does not retain source files or cached results, but the project includes no technical control ...[truncated 1610 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Provide a local contract-processing mode and make it the default. 2. Obtain explicit, informed consent immediately before every external upload. 3. Clearly disclose: - The receiving organization and endpoint. - The categories of data transmitted. - Processing and storage jurisdictions. - Retention and deletion periods. - Whether data is used for model training or secondary purposes. 4. Show the exact file path and destination to the user before transmission. 5. Offer automatic redaction of personal data, signatures, account details, and trade secrets. 6. Upload only the minimum text necessary for the requested review rather than the original complete file. 7. Restrict the runner's filesystem access to a temporary copy of the selected document. 8. Use an isolated process with no access to unrelated home-directory files. 9. Encrypt data in transit and verify the remote endpoint's identity. 10. Establish auditable deletion controls rather than relying solely on a textual no-retention claim. 11. Warn users not to upload privileged, regulated, or third-party-confidential documents unless they are authorized to do so. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:137
• Finding: User API Key Is Requested Through Chat and Persisted Without Defined Secret Protections<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:83-85` and `SKILL.md:137-139` **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Complete Code Snippet The Skill instructs users and the Agent as follows, translated into English: ```text Obtain an API key by registering at https://cuecue.cn/hub/api-key. After obtaining the key, send it directly to the current AI assistant and say: "This is my key; please configure the environment for me." The assistant will automatically retrieve the underlying scripts and write the configuration file. ``` The Agent execution section states: ```text After the user provides an API key, the Agent must prepare the runtime environment. 1. Check and write the API key: if ~/.cue/config.json does not exist, use the user's key to automatically generate and write it. ``` ### Technical Analysis The Skill asks the user to disclose an API credential directly in the conversation and then persists that credential in `~/.cue/config.json`. It does not specify restrictive file permissions, encryption, operating-system credential storage, log redaction, token scoping, expiration, or rotation. Secrets entered into a chat interface may be retained in conversation history or operational logs. A plaintext configuration file may also be readable by other local processes or users if default permissions are overly broad. The remotely downloaded runner is expected to consume the credential and therefore represents an additional secret-access boundary. The conditional behavior only writes the key when the file does not exist. It does not define how to safely replace, revoke, expire, validate, or remove an old credential. ### Attack Path 1. The user sends the API key to the Agent in a conversation. 2. The key may become part of conversation records or application telemetry. 3. The Agent writes the key to `~/.cue/config.json`. 4. No documented permission or encryption control protects the file. 5. A ...[truncated 892 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into conversation messages. 2. Accept credentials through a dedicated secret-input mechanism that prevents inclusion in chat history and logs. 3. Store the key in an operating-system credential manager or approved secret store. 4. If a configuration file is unavoidable: - Create it with permission mode `0600`. - Use atomic creation that fails if permissions cannot be enforced. - Avoid printing the key in command output or errors. - Exclude the file from backups and source control where appropriate. 5. Use short-lived, narrowly scoped tokens rather than long-lived account credentials. 6. Redact secrets from telemetry, subprocess arguments, exception traces, and generated reports. 7. Document revocation, rotation, replacement, and secure deletion procedures. 8. Pass the credential only to a reviewed and integrity-verified process. 9. Warn the user immediately if a key has already been disclosed in chat and recommend rotating it. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The description encourages users to upload contracts and cross-check counterparty records through an external service without a clear upfront warning that contract contents and identifying information will be transmitted off-platform. For legal-review workflows, this context is especially sensitive because contracts often contain confidential business terms, personal data, and privileged information.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The skill tells users to send their API key directly to the AI assistant, but does not present a prominent credential-handling warning or a safer alternative. This normalizes secret-sharing in chat and can lead to credential disclosure through transcripts, logging, model retention, or operator access.

Ssd 3

High

• Confidence: 99% confidence
• Finding: Instructing the agent to have the user paste an API key into chat is a direct secret-exposure pattern. Chat channels are commonly logged, retained, reviewed, or reused, so collecting credentials this way materially increases the chance of unauthorized disclosure or later misuse.

Description-Behavior Mismatch

High

• Confidence: 92% confidence
• Finding: The skill claims uploaded source files and results are not retained, yet later requires generation of a shareable remote report link tied to a conversation ID. That inconsistency can mislead users about where sensitive contract data is stored or accessible, causing confidentiality and compliance risk for legal documents.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The skill goes beyond receiving a secret and explicitly persists the user-provided API key into a local configuration file. Persisting credentials obtained through conversation increases the blast radius through filesystem exposure, backup leakage, permission mistakes, and unintended reuse by unrelated tools or sessions.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: Terms like “合同审查”, “合同风控”, “合规审查”, and “条款审查” describe broad tasks rather than precise activation conditions. The file does not define when these phrases should trigger the skill versus ordinary discussion of legal review work.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The trigger phrase “审一下这份合同” is a natural conversational request rather than a narrowly scoped invocation cue. Without exclusion conditions or tighter activation constraints, it could cause unintended activation whenever a user casually asks for help reviewing a contract.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The skill directs the agent to accept a user API key via chat and write it into a local config file, giving the skill credential-handling behavior beyond its contract-review purpose. Secrets passed through conversation and persisted to disk can be exposed in logs, transcripts, backups, or later misuse by other processes.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to clone and update a remote Git repository to obtain and execute tooling, which expands a legal-review skill into software installation and supply-chain behavior. This creates avoidable risk of fetching unreviewed code, repository compromise, or executing changed upstream content unrelated to the user's contract-review request.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The instruction mandates a specific Chinese message to users before execution, which effectively forces a language choice. The file does not offer user opt-in or explain that the skill is limited to Chinese-language interactions.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The prescribed message for insufficient credits is hard-coded in Chinese and marked as required behavior. Because no alternative language path or opt-in is provided, this creates an avoidable locale-policy issue for non-Chinese users.

Intent-Code Divergence

Low

• Confidence: 84% confidence
• Finding: The documentation tells the agent not to read text locally and to upload the file directly, but immediately provides a branch where, if the user pasted text, the full contract body should be placed into the command-line query. This is an active contradiction in the operational guidance about whether local text handling is permitted.

Static analysis

No suspicious patterns detected.