ClawHub
Back to skill

Security audit

疑难法律实操案例库

Security checks for vulnerabilities and agentic risk

Overview

The legal-research workflow is coherent, but its handling of API keys and confidential case details needs review.

Configure the API key locally through a protected file or supported secret mechanism instead of pasting it into chat; rotate any key already shared. Remove confidential and identifying case details before requesting research, and understand that Cue receives the question. Review runner updates and report-link access before using sensitive material.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Output HandlingUnvalidated Output Injection, Cross-Context Output, Unbounded Output
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (9)

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
99% confidence
Finding

所提供代码的全部行为是本地文档格式转换，没有检索裁判文书、监管问答或实务案例，也没有开展法律争议分析。文档导出可以作为法律研究流程的辅助步骤，但该片段没有体现与法律研究流程的关联，实际展示的主要用途与声明存在实质差异。

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

The supplied code only initializes a local credential configuration; it does not search legal sources or analyze cases. Configuration can be a supporting implementation detail, but this chunk provides no connection between the ~/.cue configuration and the declared legal-research functionality. Its demonstrated behavior therefore differs materially from the stated purpose. There is no evidence of credential theft or network transmission.

Content

No source excerpt is available for this finding.

The workflow sends the user's verbatim legal question to Cue without a warning about sensitive case information.

High
Category
Output Handling
Confidence
95% confidence
Finding

The runner receives the user's question verbatim for processing by an external service, with no required redaction or sensitive-information consent step. Although the remote architecture is disclosed elsewhere, legal questions can contain identifying information, confidential evidence, or privileged communications, making indiscriminate transmission particularly risky.

Content

No source excerpt is available for this finding.

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 229)May include surrounding context.

CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='法律合规' for b in s.get('buddies',[]) if b.get('title')=='疑难法律实操案例库'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"

text

| 检查 | 预期 | 异常处理 |

Report output is fixed to Chinese without offering the user a language choice.

Medium
Category
Output Handling
Confidence
86% confidence
Finding

The output specification explicitly requires a Chinese-language report, and the FAQ repeats this requirement at lines 347–348 without an opt-in or alternative. The domestic legal-source scope explains the jurisdiction covered, but does not explicitly justify requiring Chinese output regardless of the user's preferred language.

Content

No source excerpt is available for this finding.

Users are instructed to paste an API key into the agent conversation without a credential-exposure warning.

Medium
Category
Output Handling
Confidence
98% confidence
Finding

The skill repeatedly instructs users to paste an API key into the agent conversation, exposing a reusable credential to chat history and potentially associated logs or integrations. Unauthorized access to that credential could permit account API usage and consume credits; the statement that the agent cannot view keys does not protect a key pasted into its conversation.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
60% confidence
Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.

Cue API Key：在 cuecue.cn 注册后免费创建，新账号送 500 积分 + 每天 10 积分。点击「创建 API Key」，生成 API Key 后一定要点击「复制」并粘贴发送给您正在使用的智能体。写入 ~/.cue/config.json：

bash
mkdir -p ~/.cue
echo '{"api_key": "sk你的key"}' > ~/.cue/config.json

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 200)May include surrounding context.

md
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
70% confidence
Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 201)May include surrounding context.

md
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |

---

Static analysis

No suspicious patterns detected.