Security audit
Security checks for vulnerabilities and agentic risk
Review before installing: this skill automatically updates and runs external code, and its API-key instructions contradict its privacy assurances.
Review and pin the runner before execution, and make updates a deliberate choice. Configure the API key locally rather than sending it in chat. Product queries go to Cue, research consumes service credits, and generated reports should be checked against the original policy documents.
Document conversion could support report delivery, but it is the entirety of the supplied code. There is no Cue usage, policy analysis, product comparison, or generation of the promised substantive draft. The mismatch concerns the materially different implemented purpose, not the use of Pandoc as an implementation detail.
Installing a runner is a disclosed dependency, not inherently a description-behavior mismatch. However, the skill instructs the agent to clone or update a mutable external repository and then execute its Python code without pinning or verifying the revision; compromise of the upstream repository or fallback mirror could therefore yield code execution with the agent's permissions and access to local credentials.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='保险营销' for b in s.get('buddies',[]) if b.get('title')=='保险产品条款核查'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L113 and L165 explicitly state that the agent has no authority to view the user's API key. However, the agent-run diagnostic at L176 loads the plaintext key from ~/.cue/config.json, falling back to CUE_API_KEY, and uses it in the subsequent requests. Although the command does not print the key, its direct credential access contradicts the documented restriction.
No suspicious patterns detected.