Security audit
Security checks for vulnerabilities and agentic risk
This fact-checking skill needs review because it automatically updates and runs external code that can access its saved API key.
Prefer a reviewed runner version pinned to a commit, with explicit approval before updates. Use a dedicated Cue key and restrict the runner's file access. Submit only material you may share with Cue, check credit costs, and confirm report-link access before sharing sensitive reports.
Document conversion could support a fact-checking workflow, but it is the entirety of the supplied code. The chunk does not retrieve independent sources, review underlying data, assess claims, or construct the declared evidence-backed report. The mismatch concerns the primary behavior, not the use of Pandoc or XeLaTeX as implementation details.
Installing a runner is consistent with the disclosed fact-checking workflow, so downloading dependencies is not itself a purpose mismatch. However, the skill automatically clones or updates an unpinned repository, including a fallback mirror, and subsequently executes its Python runner; a compromised upstream could therefore execute code with the agent's filesystem and credential access.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='深度核查' for b in s.get('buddies',[]) if b.get('title')=='事实核查'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
The workflow passes original material to an external service and explicitly targets potentially confidential due-diligence and business information. Although the architecture section discloses remote processing, the invocation instructions do not require sensitivity screening, redaction, or confirmation before transmitting such material, creating a risk of unintended third-party disclosure.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L113, L165, and L184 explicitly state that the agent has no right to view the user's API key. However, L176 reads the complete key from ~/.cue/config.json or CUE_API_KEY into a shell variable, and L178–L179 use it for authentication. Authentication is appropriate for this skill, but the documented prohibition contradicts the supplied credential-handling code.
No suspicious patterns detected.