T03 · Remote Payload Retrieval and Execution
Warning
- Location
- SKILL.md:71
- Finding
- Unpinned Remote Runner Retrieval and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 71 and 91–94 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```markdown Runner installation: `git clone https://github.com/sensedeal/cue-skills.git ~/.cue/cue-skills` ([Gitee mirror](https://gitee.com/sensedeal/cue-skills)). ``` ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "user-provided case information and document requirements" \ --template-id <retrieved from /api/playbook> \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-litigation-drafting.md ``` ### Technical Analysis The Skill instructs users to clone an external Git repository and then execute a Python script from that repository. The clone operation does not pin a reviewed commit, signed tag, release artifact, or cryptographic checksum. Consequently, the code executed at invocation time can differ from the code that existed when this Skill was reviewed. Although this also presents a general supply-chain concern, the defining behavior is direct retrieval and execution of a mutable remote payload. The external runner is not included in the audited project, so its implementation and future behavior cannot be verified from the supplied artifact. The Skill also stores the Cue API key under `~/.cue/config.json` and processes potentially sensitive legal case information. A maliciously modified runner would execute with the invoking user's permissions and could attempt to read those resources or other files accessible to that account. ### Attack Path 1. An attacker compromises the upstream `sensedeal/cue-skills` repository, a maintainer account, or the distribution path. 2. The attacker modifies `cue-research/scripts/research_run.py` or one of its imported modules. 3. A user follows the documented installation command, cloning the mutable repository without verifying a commit or checksum. 4. The Agen ...[truncated 940 chars]
- Remediation
- ## Remediation Suggestions - Pin the runner to a specific, reviewed commit hash rather than cloning the repository's current default branch. - Prefer a signed, versioned release artifact and verify its signature before execution. - Publish a SHA-256 or stronger cryptographic digest for the approved runner and fail closed if verification does not succeed. - Vendor the reviewed runner into the Skill package where licensing and maintenance constraints permit, making the executed code part of the auditable artifact. - Review and pin transitive code imported by `research_run.py`. - Execute the runner in a sandbox or container with a read-only filesystem where possible, a narrowly scoped writable output directory, and restricted network destinations. - Provide credentials through a narrowly scoped mechanism and ensure the API key has minimal permissions, rotation support, and revocation capability. - Require explicit user confirmation before transmitting legal materials and advise users to redact privileged, confidential, personal, or court-restricted information. - Document the exact approved runner version and establish a controlled update and re-audit process.