Security audit
Security checks for vulnerabilities and agentic risk
The reporting workflow fits its purpose, but setup asks you to share an access key in chat while giving conflicting assurances about the agent’s access to it.
Configure your Cue key through a protected local mechanism instead of pasting it into chat; rotate a key already shared there. Review the downloaded runner and updates before execution. Queries go to Cue, and optional scheduled reports continue consuming credits until disabled.
The supplied chunk performs only Git repository maintenance and local filesystem changes. Although this could support a larger Cue workflow, no such workflow is implemented or invoked here. The mismatch is the materially different implemented purpose, not merely the use of Git or a supporting download. The chunk does not execute downloaded code or collect the information described.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='商机挖掘' for b in s.get('buddies',[]) if b.get('title')=='区域政策商机简报'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| 环境 | 配置方式 |
|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `0 9 * * 1`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.regional-policy-brief.plist`，`StartCalendarInterval` 设 `Weekday` 1、`Hour` 9、`Minute` 0，再 `launchctl load` |
| Linux | `crontab -e` 追加 `0 9 * * 1 <上面的命令>` |
配完必须回报三件事：**触发时间、绑定区域、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| 环境 | 配置方式 |
|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `0 9 * * 1`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.regional-policy-brief.plist`，`StartCalendarInterval` 设 `Weekday` 1、`Hour` 9、`Minute` 0，再 `launchctl load` |
| Linux | `crontab -e` 追加 `0 9 * * 1 <上面的命令>` |
配完必须回报三件事：**触发时间、绑定区域、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
|------|---------|
| Claude Code | 用 `CronCreate`，cron 表达式 `0 9 * * 1`（自定义时间按用户所选取 分 时 日 月 周） |
| macOS | 建 `~/Library/LaunchAgents/com.cue.regional-policy-brief.plist`，`StartCalendarInterval` 设 `Weekday` 1、`Hour` 9、`Minute` 0，再 `launchctl load` |
| Linux | `crontab -e` 追加 `0 9 * * 1 <上面的命令>` |
配完必须回报三件事：**触发时间、绑定区域、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
| macOS | 建 `~/Library/LaunchAgents/com.cue.regional-policy-brief.plist`，`StartCalendarInterval` 设 `Weekday` 1、`Hour` 9、`Minute` 0，再 `launchctl load` |
| Linux | `crontab -e` 追加 `0 9 * * 1 <上面的命令>` |
配完必须回报三件事：**触发时间、绑定区域、如何关掉**（Claude Code 删任务 / `launchctl unload` / `crontab -e` 删除对应行）。
### 必须提前告知的两个坑
The skill repeatedly instructs users to paste an API key into the agent conversation, unnecessarily placing a reusable credential in chat history and potentially retained logs. Anyone who subsequently obtains that credential could perform whatever actions its permissions allow, including consuming the user's Cue credits.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L176, L287, and L306 state that the agent cannot view the user's API key. However, L298 explicitly reads the raw key from ~/.cue/config.json or CUE_API_KEY into a shell variable, and L300–L301 use it for authentication. Authentication is appropriate for this skill, but the stated credential-access restriction contradicts the supplied implementation.
No suspicious patterns detected.