ClawHub
Back to skill

Security audit

市值管理

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent research purpose, but it asks the agent to clone or update and then execute mutable remote code from outside the reviewed package.

Install only if you trust Sensedeal/Cue’s remote cue-skills repository and are comfortable with a persistent checkout under ~/.cue being updated and executed locally. Prefer a pinned, reviewed runner version; the runner will use your Cue API key and may spend credits after confirmation.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Context-Inappropriate Capability

High
Confidence
98% confidence
Finding
The skill instructs the agent to clone or update code from a remote Git repository and then rely on that fetched code as the execution path. This creates a supply-chain and arbitrary code execution risk because the repository contents can change over time, may be compromised, and are not pinned, verified, or scoped to the minimum capability needed for market-cap research.

Natural-Language Policy Violations

Medium
Confidence
92% confidence
Finding
The skill’s manifest and instructions are entirely written in Chinese and describe the skill as operating in the Chinese '市值管理' scene, with no indication that users may choose another language. This is a natural-language locale policy concern because the file effectively constrains interaction to a specific language without documenting user choice or justified locale limitation.

Context-Inappropriate Capability

Medium
Confidence
93% confidence
Finding
The core workflow requires executing a local Python script with user-controlled query input, which expands the skill from information retrieval into code execution. Even if the script is intended for research, invoking external scripts introduces risk from script behavior, transitive logic, environment access, and unsafe handling of arguments or downstream network actions.

Static analysis

No suspicious patterns detected.