Security audit
Security checks for vulnerabilities and agentic risk
The research workflow fits its purpose, but automatic runner updates and conflicting rules about access to your API key warrant review.
Before installing, review and pin the runner version and approve later updates separately. Clarify that the API key may be used for Cue authentication without being pasted into chat or displayed, and retain the ability to cancel tasks. Company queries go to Cue, research consumes credits, and reports remain locally. The reviewed artifacts do not establish malicious behavior.
Document export could support a prospecting workflow, but the supplied chunk contains only generic Markdown-to-Word/PDF conversion commands and no connection to the declared workflow. Its demonstrated primary function therefore materially differs from the declared purpose.
Installing a runner is a disclosed prerequisite, not inherently a description-behavior mismatch. However, the instructions automatically clone or update an unpinned repository and subsequently execute its Python code; compromise of the upstream repository or mirror could therefore execute attacker-controlled code with the agent's local permissions, including access to Cue credentials.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
CUE_KEY=$(python3 -c "import json;print(json.load(open('$HOME/.cue/config.json'))['api_key'])" 2>/dev/null || echo "$CUE_API_KEY") echo "=== 1/3 API Key ===" && [ -n "$CUE_KEY" ] && echo "已配置" || echo "未配置！" echo "=== 2/3 Cue 服务 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/health" -H "Authorization: Bearer $CUE_KEY" echo "=== 3/3 搭子 ===" && curl -sS --max-time 10 "https://cuecue.cn/api/playbook" -H "Authorization: Bearer $CUE_KEY" | python3 -c "import sys,json;scenes=json.load(sys.stdin).get('data',{}).get('scenes',[]);buddy=[b for s in scenes if s.get('secondary_category')=='商机挖掘' for b in s.get('buddies',[]) if b.get('title')=='产业链上下游拓客'];print(f'可用:{len(buddy)}个') if buddy else print('暂不可用')"
| 检查 | 预期 | 异常处理 |
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
| 目标格式 | 依赖 | macOS | Ubuntu |
|----------|------|-------|--------|
| Word (.docx) | pandoc | `brew install pandoc` | `sudo apt install pandoc` |
| PDF (.pdf) | pandoc + LaTeX | `brew install --cask basictex` | `sudo apt install texlive-xetex` |
---
L130 and L181 explicitly state that the agent has no authority to view the user's API key. However, L192 instructs the agent to execute code that reads the complete key from ~/.cue/config.json, falling back to CUE_API_KEY, and L194-L195 use it in agent-issued requests. Authentication is expected for this skill, but this credential-handling procedure contradicts its documented access boundary.
No suspicious patterns detected.