境外诉讼案例库

• Outcome: Review
• Latest audit: Sep 8, 2026 · 3:32 AM UTC
• Version: 1.2.5

Overview

This legal research skill is coherent, but it requires trusting an unpinned external runner while storing an API key locally and sending research queries to Cue's service.

Install only if you are comfortable running Cue's external runner from the referenced repository and sending your legal research queries to Cue's servers. Treat the Cue API key as a secret, restrict ~/.cue/config.json permissions, avoid putting confidential or privileged facts in prompts unless approved, and prefer a pinned or verified runner version before use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:69
• Finding: Execution of an Unpinned Externally Maintained Runner< ([Gitee mirror](https://gitee.com/sensedeal/cue-skills)). ``` ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --query "<original user query>" \ --template-id <runtime template_id> \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-overseas-litigation.md ``` ### Technical Analysis The Skill does not include the runner it instructs the Agent to execute. Instead, it relies on a Python program obtained from an external GitHub repository or Gitee mirror. The documentation does not pin the runner to an immutable commit or signed release and does not require verification through a cryptographic checksum or signature. Consequently, the executable implementation reviewed by a user at one point may differ from the implementation later installed or executed. Compromise of the upstream repository, maintainer account, distribution mirror, or update process could substitute malicious Python code. The externally hosted runner is executed directly with the invoking user's permissions. It also receives the user's original query and a server-selected template identifier. This dependency model exceeds the minimum trust necessary for a documentation-only Skill because the security of the local execution environment depends on mutable code that is absent from the audited package. The pre-scan warning concerning a direct `curl | bash` pipeline was not confirmed. The command at line 157 pipes an API JSON response into a fixed local Python JSON parser, not into a shell. The relevant code-execution risk instead arises from the separately sourced and unpinned runner. ### Attack Path 1. An attacker compromises the upstream `sensedeal/cue-skills` repository, its maintain ...[truncated 1669 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the runner to an immutable Git commit or versioned release instead of relying on a mutable branch. 2. Publish an expected SHA-256 or stronger cryptographic digest and require verification before execution. 3. Sign releases and verify signatures against a documented, independently distributed maintainer key. 4. Prefer bundling the reviewed runner source inside the Skill package so that the complete executable behavior is available during audit. 5. Do not treat the GitHub and Gitee copies as interchangeable unless both are verified against the same trusted digest. 6. Document the precise installation command and prevent silent or automatic updates. 7. Review changes before upgrading to another pinned runner version. 8. Run the runner in a sandbox with access limited to: - The Cue configuration required for authentication. - A dedicated output directory. - The declared Cue API endpoints. 9. Deny access to unrelated home-directory files and environment variables where the execution platform supports filesystem and process isolation. 10. Ensure that server-provided template data is treated strictly as data and cannot control imports, shell commands, file paths, or executable code. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:78
• Finding: Cue API Key Stored Without Explicit Restrictive File Permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 78-83 **Vulnerability Type**: Insecure local secret storage **Risk Level**: Low ### Relevant Code ```bash mkdir -p ~/.cue echo '{"api_key": "sk-your-key"}' > ~/.cue/config.json ``` ### Technical Analysis The setup instructions store the Cue API key in a plaintext JSON file. Plaintext configuration may be necessary for the runner, but the instructions do not explicitly restrict the permissions of either `~/.cue` or `~/.cue/config.json`. The resulting access mode depends on the user's current `umask`, pre-existing directory permissions, operating system, and filesystem. On a system with permissive defaults, another local account or process may be able to read the credential. The use of `echo` can also expose the literal setup command in shell history when a user manually substitutes the real key into the command. This does not demonstrate deliberate credential theft, and the health-check commands send the key only to the declared `https://cuecue.cn` service. Nevertheless, the documented secret-storage procedure lacks minimum hardening controls. ### Attack Path 1. A user replaces the placeholder with a real Cue API key and runs the documented command. 2. The file is created under a permissive `umask`, or the existing `~/.cue` directory has overly broad permissions. 3. Another local user or compromised process enumerates the user's readable files. 4. The attacker reads `~/.cue/config.json` and obtains the API key. 5. The attacker submits unauthorized requests to the Cue service using the stolen credential. An alternative exposure path exists if the user enters the real key directly in an interactive shell and the full command is retained in shell history. ### Impact Assessment The exposed credential may permit an attacker to act within the authorization scope assigned to the Cue API key. Potential consequences include: - Unauthorized use of the Cue service. - Consumption of the vict ...[truncated 416 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Create the configuration directory with owner-only permissions: ```bash install -d -m 700 "$HOME/.cue" ``` 2. Create or update the configuration file with mode `600`, independent of the current `umask`. 3. Avoid placing the real API key directly in an interactive shell command that may be retained in shell history. 4. Prefer a secure interactive prompt, an operating-system credential store, or a secrets-management facility. 5. If an environment variable is supported, document its process-exposure limitations and ensure it is scoped only to the runner process. 6. Validate permissions before reading the credential and warn or fail when the file is accessible to group or other users. 7. Provide API-key rotation and revocation instructions in case local disclosure is suspected. 8. Use a narrowly scoped credential with credit limits and only the API permissions necessary for research execution. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to store a live API key in a predictable local file path (`~/.cue/config.json`) but does not warn that the key is sensitive, should be protected by file permissions, or should not be shared in logs/screenshots. This increases the risk of credential leakage through shell history, backups, multi-user systems, or accidental disclosure during support/debugging.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill describes sending authenticated requests and user queries to Cue's remote service, which then accesses external legal and regulatory sources, but does not clearly warn users that their prompts and related data leave the local environment. For legal/compliance research, user queries may contain confidential company names, dispute facts, or investigation topics, so silent off-device transmission creates meaningful privacy and confidentiality risk.

Static analysis

No suspicious patterns detected.