Security audit

新兴产业研究

Security checks for vulnerabilities and agentic risk

Overview

The skill’s research purpose is coherent, but it depends on running an unaudited external Cue runner from mutable repositories and gives that runner local credential and file access.

Review the external Cue runner source and provenance before installing, prefer a pinned and verified revision, use a narrowly scoped Cue API key, and treat generated reports as untrusted research output rather than instructions to follow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:59
Finding: Execution of an Unpinned and Externally Managed Runner<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59-75 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Evidence ```markdown **首次使用运行 skill 自带的一键安装脚本**（检查依赖 → 克隆 runner → 验证 Key → 测试连通性）： ```bash ``` 依赖：`git` + `python3` + `curl`。Python 仅用标准库，无额外 pip 依赖。 Cue API Key：[cuecue.cn](https://cuecue.cn/hub/api-key) 注册获取。 Runner 来源：[GitHub - sensedeal/cue-skills](https://github.com/sensedeal/cue-skills)（[Gitee 镜像](https://gitee.com/sensedeal/cue-skills)）。 --- ## 调用说明 ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ ``` ### Technical Analysis The Skill's core functionality relies on a Python runner obtained separately from mutable GitHub or Gitee repositories. The project does not contain the claimed installation script or the runner itself, and it does not specify an immutable commit, version tag with integrity verification, cryptographic checksum, or signature. As a result, the behavior ultimately executed by the Skill cannot be determined by auditing this package alone. A repository owner, compromised account, compromised mirror, or network/software-supply-chain attacker could modify the runner after this Skill has been reviewed. This dependency exceeds the minimum safely verifiable privilege needed for industry research. The external runner executes as the current user and may consequently access anything available to that account, rather than operating inside a constrained research-only environment. ### Attack Path 1. An attacker compromises the upstream GitHub repository, its Gitee mirror, a maintainer account, or the installation/distribution process. 2. The attacker replaces the expected runner with modified Python code. 3. A user follows the Skill instructions and installs or updates the external runner without integrity verification. 4. The Skill invokes: `python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py`. 5. The modified runner executes with the Agent ...[truncated 892 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Bundle the complete runner and installer inside the Skill so their behavior can be audited together. 2. If external retrieval is necessary, pin the runner to an immutable commit identifier rather than a branch or mutable release. 3. Publish and verify a SHA-256 or stronger checksum before execution. 4. Prefer signed releases and verify signatures against a documented, trusted maintainer key. 5. Do not silently switch between GitHub and Gitee mirrors; require each source and artifact to pass the same integrity verification. 6. Display the exact source revision and verified digest before running the dependency. 7. Execute the runner in a sandbox with access limited to the required output directory, Cue endpoint, API credential, and research query. 8. Use a narrowly scoped, revocable API token rather than a broadly privileged credential. 9. Add the missing installation procedure to the package and ensure it fails closed when integrity verification cannot be completed. ]]>

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:17
Finding: Mandatory Verbatim Delivery of Untrusted Remote Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 17-22 and line 112 **Vulnerability Type**: `T01: Skill Instruction Hijacking` **Risk Level**: Medium ### Evidence ```markdown | 顺序 | 做什么 | 禁止 | |------|--------|------| | 1 | 确认 Cue runner 就绪 | 禁止跳过 | | 2 | 告知用户耗时 2-15 分钟 | 禁止中途取消 | | 3 | 一条命令，`--template-id template_BbE7-1`，传入赛道名称 | 禁止连发多条 | | 4 | `[cue-research] RESULT ok` = 完成 | 禁止编造 | | 5 | 原样交付研报 | 禁止概括 | ``` ```markdown 本 Skill **不在本地执行检索**。流程是 Agent → Cue API（cuecue.cn）→ 外部数据源。解析结果的质量和时效取决于 Cue 服务端和外部数据源的状态。 ``` The relevant instructions require the report to be delivered unchanged and state that its contents originate from the Cue API and external data sources. ### Technical Analysis The Skill directs the Agent to deliver a remotely assembled report verbatim and prohibits summarization. Remote service responses and external source material are untrusted input. They may contain instruction-like text, deceptive operational guidance, malicious links, fabricated claims, or content designed to manipulate an Agent or user. The mandatory verbatim-delivery rule weakens the Agent's ability to distinguish external report data from trusted Skill instructions and prevents normal filtering, warning, redaction, or contextualization. If downstream systems interpret the report as instructions rather than quoted data, this creates a prompt-injection or instruction-hijacking path. The external content does not inherently obtain system privileges merely by being returned. Exploitation requires the Agent, user, or another automated component to act on embedded instructions or links. ### Attack Path 1. An attacker publishes content likely to be collected by an external research source, compromises such a source, or compromises the Cue response path. 2. The attacker embeds instruction-like text, deceptive links, or requests to disclose information or execute commands. 3. Cue incorporates that content into the generated research report. 4. The r ...[truncated 973 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove the requirement to deliver remote reports unchanged. 2. Explicitly classify Cue responses and external-source material as untrusted data, not Agent instructions. 3. Place returned reports inside a clearly delimited quoted or data-only section. 4. Scan reports for instruction-like content, credential requests, executable commands, and suspicious links before presentation. 5. Permit redaction of dangerous content while preserving a notice that material was removed for safety. 6. Validate links and distinguish cited research sources from operational links that ask users to authenticate, download files, or execute commands. 7. Instruct the Agent never to follow directives embedded in the report. 8. If exact reproduction is required for evidentiary purposes, provide both a quarantined verbatim attachment and a separately generated safety-reviewed summary. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.