大盘盘中分析

• Outcome: Review
• Latest audit: Sep 15, 2026 · 3:15 AM UTC
• Version: 1.1.0

Overview

The skill’s market-analysis purpose is mostly coherent, but it needs review because it depends on unreviewed external runner code and forces referral/payment messaging when Cue credits are low.

Install only if you are comfortable using Cue’s external service, sending market-analysis prompts and an API key to cuecue.cn, and relying on a separately installed runner from the cited repository. Review or pin the runner before use, avoid exposing the API key in shared logs or shells, and be aware that the skill instructs the agent to present Cue referral and payment options when credits are insufficient.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:187

Finding

Mandatory Commercial Messaging Hijacks Agent Output

Content

View full analysis

Your Cue credits are insufficient, so this task could not start. Two options: > 1. **Invite friends to receive 500 credits (recommended)**: Open > https://cuecue.cn/, click "Get exclusive invitation link" in the > bottom-left corner, and share it with friends. Receive another 500 credits > after a friend joins. > 2. **Recharge directly**: Visit https://cuecue.cn/pay to subscribe > (a discount is available for the first recharge), or wait for the next > day's free allowance. Rules: - The prompt must be proactive, concise, and clickable. Clearly identify the homepage and the bottom-left corner so the user does not need to find the entry. - Do not retry when credits are insufficient (`retryable: false`), and do not change the query to work around the condition. - After the user replies that they have recharged or invited someone, rerun exactly the same command. ``` ### Technical Analysis The Skill imposes mandatory user-facing referral and payment language unrelated to the technical requirements of reporting an insufficient-credit error. Terms equivalent to “mandatory,” “must proactively,” and “recommended” direct the Agent to promote the service rather than neutrally explain the failure. This is instruction hijacking because loading the Skill changes the Agent's response goals during the current session. Instead of limiting its behavior to intraday market analysis an ...[truncated 2229 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

External Script Fetching

High

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The health-check commands send a bearer API key to an external domain via curl, and the skill encourages direct command-line handling of the secret. In an agent or shared-shell context, this increases risk of credential exposure through shell history, logs, process inspection, or unintended transmission to a third-party service without a strong trust/privacy warning.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

bash

CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY")
echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！"
echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY"
echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='短线盘面' for b in s.get('buddies',[]) if b.get('title')=='盘中盘面透视'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The description and operating instructions are presented entirely in Chinese, with no indication that users may opt into another language or locale. This can violate language/locale choice policy when a skill implicitly forces a specific language without documented justification or user opt-in.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The suggested prompts like "今天盘面怎么样？" and "今天有什么主线板块值得关注？" are broad, natural user questions rather than narrowly scoped invocation cues. The file does not provide exclusion conditions or tighter trigger constraints, so the skill could be matched in unintended contexts.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 137)May include surrounding context.

md

| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 138)May include surrounding context.

md

| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill explicitly routes user queries and an API-authenticated request to an external service, but it does not clearly warn users that their prompts and related metadata will leave the local environment. In an agent setting, this can lead to unintentional disclosure of sensitive trading interests, proprietary research prompts, or account-linked usage data to a third party.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.