Security audit
Security checks for vulnerabilities and agentic risk
This legal-research skill needs review because it requires sending questions unchanged to Cue without checking for sensitive details and leaves cancellation controls unclear.
Submit an already anonymized question, excluding names, identifiers and confidential business details. Review and pin the runner before execution, keep API keys out of chat, and ensure your agent honors stop requests. Check the report's cited official sources.
The code contains only Markdown-to-DOCX and Markdown-to-PDF conversions. It does not retrieve legislation, consult official sources, check legal validity, or analyze compliance requirements. Document export could support a legal-research workflow, but no such workflow is present in the supplied chunk; its demonstrated primary purpose is document conversion.
Installing a runner supports the declared research workflow, so downloading a repository is not inherently a purpose mismatch. However, the skill instructs agents to clone or update an unpinned repository and subsequently execute its Python code; compromise of the upstream repository or fallback mirror could introduce code that accesses local files and credentials with the agent's permissions.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='法律合规' for b in s.get('buddies',[]) if b.get('title')=='国内法规调研'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Cue API Key：在 cuecue.cn 注册后免费创建，新账号送 500 积分 + 每天 10 积分。写入 ~/.cue/config.json：
mkdir -p ~/.cue
echo '{"api_key": "sk你的key"}' > ~/.cue/config.json
The skill explicitly requires sending the user's question verbatim to an external service, while its advertised scenarios include employment disputes, family matters, personal information, and corporate compliance. Although the external-service architecture is disclosed, there is no sensitive-data minimization or consent step, so users could unintentionally disclose identifying details or confidential business information.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
L167 and L221 explicitly state that the agent has no authority to view the user's API key. However, the agent-executed health check reads the complete key from ~/.cue/config.json (or CUE_API_KEY) into a shell variable and uses it in requests. Authentication is appropriate for this skill, but the documented prohibition on credential access contradicts the prescribed implementation.
No suspicious patterns detected.