Security audit
Security checks for vulnerabilities and agentic risk
This research skill needs review because it collects an API key through chat and executes automatically updated external software.
Before installing, review and pin the runner to a specific revision and control later updates. Configure the key privately with restricted file permissions instead of pasting it into chat; rotate any key already shared there. Research queries go to Cue and may consume credits, so retain control over spending and cancellation.
The chunk contains only two document-conversion commands. It does not invoke Cue, gather industry information, analyze competition or business models, or identify legal risks. Although exporting reports could support a broader analysis workflow, no such workflow appears in the supplied code; its implemented purpose is materially different from the description.
Installing a runner is relevant to the declared research workflow, so the description mismatch alone is not the vulnerability. However, setup automatically clones or updates an unpinned external repository, with a second hosting provider as fallback, and subsequently executes Python from that checkout. A compromised repository or malicious upstream update could therefore execute code with the agent's local permissions, including access to credentials and files.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='行业研究' for b in s.get('buddies',[]) if b.get('title')=='新兴产业研究'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
The instructions repeatedly require users to paste an API key into the agent conversation rather than provision it through a protected secret channel. This unnecessarily exposes the credential to conversation storage, model context, and potentially logging or transcript-sharing systems, where unauthorized access could enable API use and consume the user's credits.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
## 架构说明
L112, L160, and L179 explicitly state that the agent has no permission to view the user's key. However, L171 reads the actual api_key value from ~/.cue/config.json or CUE_API_KEY into a shell variable, and L173–L174 use it in authorization headers. Authentication is appropriate for this skill, but the stated credential-access restriction contradicts the prescribed implementation.
No suspicious patterns detected.