Security audit

法律合规

Security checks for vulnerabilities and agentic risk

Overview

This legal-research skill is coherent, but it tells the agent to download, update, and run mutable external code that can access the user's Cue API key.

Review this skill before installing if you are not comfortable running unpinned code from the Cue repositories. Use a sandbox where practical, review or pin the runner commit yourself, and use a narrowly scoped Cue API key because the runner reads ~/.cue/config.json and consumes credits only after explicit confirmation.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T03 · Remote Payload Retrieval and Execution

Warning

Location: SKILL.md:34
Finding: Unpinned Remote Code Is Retrieved and Executed
Content: View full analysis
" --template-id ``` ### Technical Analysis The Skill instructs the Agent to clone or update a remote Git repository and then execute a Python script obtained from that repository. The dependency is not pinned to a reviewed commit hash or immutable release, and the instructions do not require checksum or cryptographic-signature verification. The `git pull --ff-only` option prevents non-fast-forward merges but does not establish trust in the downloaded content. It still accepts new commits from the configured remote. The GitHub-to-Gitee fallback also creates a second mutable source whose contents and update state may differ from the primary repository. As a result, the effective executable payload can change after this Skill has been reviewed. This behavior most directly constitutes remote payload retrieval and execution rather than merely a conventional package dependency weakness. The documentation states that the external runner automatically reads the Cue API key from `~/.cue/config.json`. There is no evidence in the audited project that the runner exfiltrates that credential; however, a future or compromised remote payload would execute with the Agent user's permissions and could attempt to access the API key and other user-readable resources. ### Attack Path 1. An attacker compromises the upstream repository, its maintainer account, the fallback mirr ...[truncated 1657 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The file presents all user-facing activation and usage instructions in Chinese only, which effectively forces a specific language/locale for users. The policy allows locale constraints only when justified or when the user is given a choice, neither of which is stated here.
Content: No source excerpt is available for this finding.