Security audit

cue-cross-border-regulation

Security checks for vulnerabilities and agentic risk

Overview

This legal-research skill needs review because it automatically forwards complete business questions to Cue and runs a helper that can update without review.

The static scan reported no findings, and the artifacts do not establish malicious intent. Before installing, review and pin the runner version. Submit only public or redacted questions unless your organization permits Cue to process confidential information, and check Cue's retention and report-sharing controls. Research calls can consume Cue credits.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Description-Behavior Mismatch

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Installing a research runner and creating local files are legitimate setup activities, and the body explicitly documents them; the description mismatch alone is not a vulnerability. However, the workflow updates executable code from an unpinned repository, falls back to a second repository without an integrity check, and subsequently runs that code with access to local credentials, creating a supply-chain exposure if either source is compromised.
Content: No source excerpt is available for this finding.

The skill mandates Chinese-language reports without offering a language choice.

Medium

Category: Output Handling
Confidence: 99% confidence
Finding: The instruction specifies fully Chinese report delivery, reinforced by the description at line 7 and the FAQ at lines 155–156. This is an explicit output-language requirement without user opt-in or a documented justification requiring Chinese for the cross-border research task.
Content: No source excerpt is available for this finding.

The advertised direct official-database research is implemented as submission of the user's verbatim question to a third-party Cue service.

Medium

Category: Excessive Agency
Confidence: 94% confidence
Finding: The advertised direct connection to official databases can give users an inaccurate understanding of the data flow: the documented implementation submits their question to Cue for server-side processing. Although the body identifies Cue, it does not clearly explain this privacy boundary before submission; legal and compliance questions can contain confidential transaction details or business plans.
Content: No source excerpt is available for this finding.

The workflow sends the user's verbatim legal or business question to Cue without a privacy warning.

Medium

Category: Output Handling
Confidence: 95% confidence
Finding: The workflow explicitly passes the user's verbatim question to a third-party service without a sensitivity review, redaction step, or clear privacy warning. In this legal-research context, that can disclose nonpublic client or business information; this overlaps with SDI-1 and should not be counted as a separate disclosure event.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.