Security audit
Security checks for vulnerabilities and agentic risk
This research skill needs review because its setup updates executable code without a fixed version and gives conflicting instructions about protecting your API key.
Review and pin the runner to a specific revision, and approve updates separately. Configure the API key locally rather than pasting it into chat. Consider Cue's handling of your queries, credit usage, and hosted reports before running research.
Document conversion could support delivery of an analytical report, but the supplied chunk only converts an existing file. It neither produces the declared analysis nor shows integration with an analysis workflow. Its demonstrated primary function therefore materially differs from the declared purpose. No malicious behavior is evident in these commands.
The supplied command performs an uninstall operation rather than industry-chain mapping or investment analysis. No declared functionality explains or authorizes this removal operation. The exact resources removed depend on the package implementation, which is not shown, but the command's stated operation is materially different from the declared purpose.
所提供的代码未执行产业链研究、公司筛选或投资分析，而是调用外部工具的卸载命令。该卸载行为与声明的研究用途没有明显关联，属于未声明且实质不同的功能。仅凭该代码无法确认实际删除或修改了哪些资源，但卸载意图已明确。
Installing a research runner is relevant to the declared workflow, so installation itself is not a purpose mismatch. However, the skill instructs the agent to clone or automatically update an unpinned repository and subsequently execute its Python code; compromise of the upstream repository could therefore expose local files and credentials with the user's privileges. Neither the GitHub source nor the fallback mirror is tied to a reviewed revision.
The supplied chunk is a setup command for an external MCP package. It contains no industry-chain analysis, company screening, investment assessment, or source-linked research. Reader setup could support a broader research implementation, but no such connection or implementation is shown here; the visible primary behavior is client setup. The package's internal actions and any specific file or network accesses beyond npx package retrieval cannot be established from this command alone.
The only visible operation is a clean invocation, rather than the declared research workflow. External package execution could be a supporting implementation detail, but the supplied chunk does not establish how this cleanup command supports industry-chain analysis. The package implementation is not supplied, so the exact cleanup targets, filesystem effects, and other runtime behavior cannot be determined.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes for b in s.get('buddies',[]) if b.get('title')=='产业链潜力股挖掘'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes for b in s.get('buddies',[]) if b.get('title')=='产业链潜力股挖掘'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L204 and L254 explicitly state that the Agent may not view the user's API key. However, the Agent-directed health check at L265 extracts the raw key from ~/.cue/config.json or CUE_API_KEY into a shell variable, then uses it in authorization headers at L267–L268. Although this does not print the key, it contradicts the stated restriction on Agent access to the credential.
npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Artifact content does not match its filename extension
No suspicious patterns detected.