Security audit
Security checks for vulnerabilities and agentic risk
The research workflow is coherent, but its API-key handling and automatic execution of unpinned external code need review before installation.
Configure a dedicated Cue API key locally instead of pasting it into chat, protect the configuration file, and use a reviewed, fixed runner version. Keep control over stopping jobs. Research questions go to Cue and runs consume credits, so consider confidentiality before submitting a question.
Document conversion could support a legal-research workflow, but the supplied chunk contains only standalone Markdown-to-Word/PDF commands and no connection to the declared research function. Its demonstrated primary purpose therefore materially differs from the description. No malicious behavior is evident.
Cue and its configuration are explained, so the claimed unexplained-tool mismatch is unsupported. Nevertheless, the setup explicitly asks users to disclose their API key in agent chat and writes it to a plaintext file without enforcing restrictive permissions, potentially exposing it through retained conversations or other local accounts under permissive default permissions.
The supplied chunk is a Cue service readiness check. It does not search public legal sources, retrieve litigation or regulatory materials, or produce the promised legal analysis. Although the foreign-law category is thematically related and authentication could support a larger research workflow, this chunk only checks connectivity and service availability. Its observable primary behavior therefore differs materially from the declared purpose. The authenticated requests alone do not establish malicious credential exfiltration.
Installing a research runner is consistent with the documented architecture, so installation alone is not a description-behavior mismatch. However, the skill downloads or updates an unpinned repository and subsequently executes its Python runner; compromise of the upstream repository or mirror could therefore execute attacker-controlled code with the agent's local permissions and access to credentials.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',[]);buddy=[b for s in scenes if s.get('secondary_category')=='涉外法律' for b in s.get('buddies',[])];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Cue API Key：在 cuecue.cn 注册后免费创建，新账号送 500 积分 + 每天 10 积分。点击「创建 API Key」，生成 API Key 后一定要点击「复制」并粘贴发送给您正在使用的智能体。写入 ~/.cue/config.json：
mkdir -p ~/.cue
echo '{"api_key": "sk你的key"}' > ~/.cue/config.json
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L061 specifies that the output is a Chinese report, and L296–L297 repeat this fixed language requirement. Although the skill focuses on implications for Chinese entities, it does not explain why Chinese output is necessary or allow users to select another language.
No suspicious patterns detected.