T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:63
- Finding
- Unpinned and Unaudited External Runner Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 63-80 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium ### Vulnerable Code ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py \ --template-id template_8qNgr5 \ --output ~/cue-reports/$(date +%Y-%m-%d-%H%M)-CATL-valuation.md ``` The surrounding instructions identify `https://github.com/sensedeal/cue-skills` and its Gitee mirror as the runner sources. However, the project contains only `SKILL.md`; it does not include the runner or the claimed one-click installation script. ### Technical Analysis The Skill instructs users or agents to execute a Python runner stored outside the audited package. It does not pin the runner to an immutable commit or release, verify a cryptographic checksum or signature, or provide the runner source for inspection. Consequently, the behavior performed by the Skill depends on a mutable external component that can change after this Skill has been reviewed. The audit found no evidence that the current external repository is malicious, but the missing integrity controls create a supply-chain vulnerability. The health-check pipeline elsewhere in the file is not remote payload execution: the Cue API response is parsed as JSON by a fixed Python expression rather than evaluated as shell or Python code. ### Attack Path 1. An attacker compromises the external runner repository, its distribution channel, or the local `~/.cue/cue-skills` installation. 2. The attacker replaces `research_run.py` with a malicious implementation while preserving its expected filename and command-line interface. 3. A user or agent follows the Skill instructions and invokes the runner with Python. 4. The substituted runner executes with the permissions of the invoking account. 5. Malicious code can access data available to that account, including the Cue configuration, submitted research queries, ...[truncated 634 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the required runner and installer inside the Skill so they can be reviewed together. 2. If external distribution is necessary, pin the runner to an immutable commit hash or signed release rather than a mutable branch. 3. Publish and verify a SHA-256 or stronger checksum before installation or execution. 4. Require cryptographic release-signature verification using a separately distributed trusted public key. 5. Replace the empty installation block with an explicit, auditable installation procedure that does not execute downloaded content directly. 6. Verify the installed runner's integrity before every invocation or install it into a versioned, read-only location. 7. Run the runner with minimum privileges in an isolated environment, granting access only to the required Cue credential, output directory, and network destination. 8. Document what query and credential data is transmitted to `cuecue.cn`, and recommend a narrowly scoped, revocable API key where supported.