全球宏观

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:41 AM UTC
• Version: 1.0.1

Overview

This skill has a legitimate macro-research purpose, but it asks the agent to download and run mutable external code that can access a local Cue API key.

Install only if you trust the Cue runner repository and are comfortable with it running locally under your user account. Prefer reviewing or pinning the runner before use, avoid passing untrusted query text through a shell command, and use a limited Cue API key where possible. Expect credit usage confirmation before each research run.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:29
• Finding: Mutable Remote Runner Is Downloaded and Executed Without Integrity Verification## Vulnerability Details **File Location**: `SKILL.md`, lines 29–45 **Vulnerability Type**: Remote payload retrieval and supply-chain risk **Risk Level**: High ### Vulnerable Code ```bash if [ -d ~/.cue/cue-skills/.git ]; then git -C ~/.cue/cue-skills pull --ff-only else git clone https://github.com/sensedeal/cue-skills ~/.cue/cue-skills \ || git clone https://gitee.com/sensedeal/cue-skills ~/.cue/cue-skills fi ``` The downloaded runner is subsequently executed: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py --query "<user subject/question>" --template-id <template_id> ``` ### Technical Analysis The Skill instructs the Agent to clone or update a remote Git repository and then execute a Python program from that repository. It does not pin the repository to an audited commit, verify a cryptographic checksum, validate a signature, or require review of changed files before execution. The `git pull --ff-only` option prevents non-fast-forward merges but does not establish code authenticity or integrity. Any new upstream commit is accepted as executable code. The fallback to a second mutable repository introduces another source whose contents may differ from the initially reviewed source. This creates a time-of-check/time-of-use supply-chain weakness: the effective runner can change after the Skill itself has been audited. The documentation also states that the runner automatically reads the Cue API key from `~/.cue/config.json`, placing that credential within reach of any compromised runner. ### Attack Path 1. An attacker compromises a supported repository, maintainer account, release process, or repository access token. 2. The attacker commits a modified `research_run.py` or changes a module loaded by that runner. 3. The Agent follows the Skill instructions and executes `git pull` or `git clone`. 4. No commit, checksum, or signature validation detects the unauthori ...[truncated 916 chars]
• Remediation: ## Remediation Suggestions 1. Vendor the reviewed runner into the Skill package so that the audited and executed code is identical. 2. If remote retrieval is necessary, pin the repository to a specific immutable commit hash rather than pulling the latest branch state. 3. Publish and verify a cryptographic checksum or signed release before executing any downloaded file. 4. Do not automatically update the repository immediately before each run. Separate updates from execution and require review of upstream changes. 5. Ensure that fallback mirrors are independently authenticated and verified to contain the exact expected commit. 6. Run the external runner in a restricted environment with minimal filesystem and network access. 7. Provide the API key through a narrowly scoped credential mechanism rather than granting the runner general access to the user's configuration directory. 8. Use a limited-scope API key, where supported, and monitor it for unauthorized requests or credit consumption.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:45
• Finding: User-Controlled Research Query Is Interpolated Into a Shell Command## Vulnerability Details **File Location**: `SKILL.md`, line 45 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py --query "<user subject/question>" --template-id <template_id> ``` ### Technical Analysis The documented command places a user-controlled research query directly inside a shell command using double quotes. Double quotes preserve spaces but do not disable all shell evaluation. In common POSIX-compatible shells, command substitutions using `$(...)` or backticks are still evaluated inside double-quoted strings. If an Agent renders the user's query into this template and submits the resulting text to a shell, a malicious query containing shell substitution can execute commands before Python receives the `--query` argument. Depending on how `template_id` is sourced and validated, unsafe interpolation of that value could provide an additional injection surface. Explicit confirmation before spending credits does not mitigate this flaw because the confirmation concerns research usage and does not validate the shell safety of the query. ### Attack Path 1. An attacker supplies a research subject containing shell command-substitution syntax. 2. The Agent inserts that subject into the documented double-quoted `--query` argument. 3. The Agent executes the rendered command through a shell. 4. The shell evaluates the injected substitution before starting `research_run.py`. 5. The injected command runs with the same privileges, filesystem access, environment, and network access as the Agent process. 6. Python may then receive only the output of the injected command as part of the query, concealing the original substitution from the runner. ### Impact Assessment Exploitation can provide arbitrary command execution as the local Agent user. An attacker could read or alter user-accessible files, access ...[truncated 388 chars]
• Remediation: ## Remediation Suggestions 1. Do not construct a shell command by concatenating or interpolating user-controlled text. 2. Invoke Python through a process API that accepts an argument array, for example the equivalent of: ```text ["python3", runner_path, "--query", user_query, "--template-id", template_id] ``` 3. If shell execution cannot be avoided, apply robust platform-appropriate argument escaping such as Python's `shlex.quote` for POSIX shells. Argument-array execution remains preferable. 4. Validate `template_id` against the identifiers returned by the trusted API and reject values outside the expected format. 5. Keep the runner path fixed or validate it against an approved installation directory. 6. Add tests using queries containing command substitutions, quotes, backticks, semicolons, newlines, and shell metacharacters to verify that each value reaches Python as one literal argument. 7. Execute the runner with least privilege and limit its access to credentials, files, and network destinations.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: All user-facing natural-language instructions and descriptions are presented only in Chinese, with no indication that the skill can operate in other languages or that Chinese is an optional locale. This can violate language/locale policy where user language choice or explicit justification is required.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The '何时用' section says only '全球宏观：宏观与日历', which does not provide specific trigger phrases, boundaries, or exclusion conditions. This broad description could overlap with many general macroeconomic or calendar-related requests and may cause unintended skill activation.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill instructs the agent to clone or update and then execute tooling from external repositories, which expands behavior far beyond macroeconomic research into arbitrary code acquisition and supply-chain risk. Because the repo is fetched at runtime and then used as the execution path for research, a compromised upstream repo, mirror, or update could lead to execution of unreviewed code on the host.

Context-Inappropriate Capability

Low

• Confidence: 84% confidence
• Finding: The skill tells the runner to read credentials from a local config file containing the Cue API key, introducing access to sensitive local secrets that is not narrowly scoped in the skill interface. Even if intended for authentication, directing a skill to rely on local secret files increases the chance of credential exposure, misuse, or normalization of secret-file access by untrusted skill content.

Static analysis

No suspicious patterns detected.