贷后监测

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:40 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent Cue loan-monitoring purpose, but it asks the agent to download and run mutable external code that can access the local Cue API key.

Install only if you trust the Cue runner repositories and are comfortable letting their current code run locally with access to your Cue configuration. Review the resolved runner code or pin a known commit before use, avoid automatic pulls, and pass research queries as structured command arguments rather than by building a shell command string.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Warning

• Location: SKILL.md:29
• Finding: Mutable Remote Runner Is Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 29–39 and 46 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Medium ### Vulnerable Code ```bash if [ -d ~/.cue/cue-skills/.git ]; then git -C ~/.cue/cue-skills pull --ff-only else git clone https://github.com/sensedeal/cue-skills ~/.cue/cue-skills \ || git clone https://gitee.com/sensedeal/cue-skills ~/.cue/cue-skills fi ``` The downloaded runner is subsequently executed: ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py --query "<user subject/question>" --template-id <template_id> ``` ### Technical Analysis The Skill instructs the Agent to clone or update a remote repository and then execute a Python file obtained from that repository. It does not pin the repository to a reviewed commit, verify a cryptographic checksum, require a signed release, or otherwise validate the downloaded code before execution. The effective code executed by the Skill can therefore change after the Skill itself has been reviewed. The `git pull --ff-only` option prevents non-fast-forward merges but does not establish authenticity or prevent a compromised upstream account from publishing malicious commits. The fallback to a separate Gitee repository expands the trust boundary. There is no verification that the GitHub and Gitee repositories contain identical, independently authenticated artifacts. The documentation also states that the runner automatically reads the Cue API key from `~/.cue/config.json`. Consequently, remotely supplied code executes in a process with access to the Agent user's files, environment, network connectivity, and potentially the Cue credential. ### Attack Path 1. An attacker compromises the upstream GitHub or Gitee repository, a maintainer account, or the branch referenced by the default clone operation. 2. The attacker adds malicious behavior to `cue-research/scripts/research_run.py` or one of its imported components. 3 ...[truncated 1192 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the runner to a specific, reviewed commit hash or immutable release rather than cloning or pulling a moving default branch. 2. Publish and verify a SHA-256 or stronger digest for every executable artifact before invocation. 3. Prefer signed releases or signed commits and validate signatures against a documented, trusted maintainer key. 4. Remove automatic `git pull` behavior. Updates should require an explicit review and approval step. 5. Verify fallback mirrors independently. Do not assume the Gitee repository is equivalent to the GitHub repository without matching signed checksums. 6. Vendor the reviewed runner into the Skill package when practical so the audited package contains the code it executes. 7. Execute the runner in a sandbox with restricted filesystem access, outbound network access, and process-creation permissions. 8. Avoid giving downloaded code direct access to the complete Cue configuration file. Supply a narrowly scoped, short-lived credential through a protected channel where supported. 9. Display and verify the resolved commit hash before every execution, and record it in audit logs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:46
• Finding: User-Controlled Query Is Interpolated Into a Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 46 **Vulnerability Type**: Command injection **Risk Level**: Medium ### Vulnerable Code ```bash python3 ~/.cue/cue-skills/cue-research/scripts/research_run.py --query "<user subject/question>" --template-id <template_id> ``` ### Technical Analysis The documented invocation places a user-controlled subject or question directly into a shell command template. Surrounding the value with double quotes is not sufficient to safely encode arbitrary untrusted input for a shell. If an Agent constructs one command string by replacing the placeholder and passes that string to a shell, an attacker can include a double quote to terminate the intended argument, followed by shell operators or command substitution syntax. For example, a query shaped like the following could change the command's structure: ```text "; id; # ``` After unsafe textual substitution, the intended `--query` argument ends early and the shell may execute `id` as a separate command. Other payloads could invoke programs, read files, or send data to a remote service. The vulnerability depends on the Agent or runtime invoking the documented command through a shell with direct textual interpolation. An argument-array invocation that bypasses shell parsing would not be vulnerable. ### Attack Path 1. An attacker supplies a loan-monitoring subject or research question containing shell syntax, such as an embedded quote followed by a command separator. 2. The Agent follows the Skill documentation and substitutes that text directly into the displayed command template. 3. The assembled command string is submitted to a shell. 4. The shell interprets part of the research query as executable syntax rather than as one inert argument. 5. The injected command runs with the privileges and environment of the Agent process. ### Impact Assessment Successful exploitation can execute arbitrary commands with the privileges of the operating-system ...[truncated 653 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Do not build a shell command by concatenating or interpolating the user query. 2. Invoke Python with a structured argument array so every value is passed as a single literal argument. For example, a Python-based launcher should use: ```python subprocess.run( [ "python3", runner_path, "--query", user_query, "--template-id", template_id, ], check=True, shell=False, ) ``` 3. If the Agent's tool interface supports direct process execution, pass the executable and each argument as separate fields rather than through `sh -c`, `bash -c`, or an equivalent shell. 4. If shell use is unavoidable, apply platform-correct shell escaping through a well-tested library. Do not rely only on surrounding input with double quotes. 5. Validate `template_id` against the value returned by the expected Cue API response and enforce its documented character format. 6. Add explicit instructions that research queries must never be evaluated as shell syntax. 7. Add regression tests using embedded quotes, semicolons, command substitutions, newlines, and shell redirection characters to confirm that the entire query remains one inert argument. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The natural-language content of the skill is entirely in Chinese and does not provide any user opt-in or alternative language option. Under the policy rule, forcing a specific language without user choice is a locale/language policy violation unless the regional constraint is explicitly documented and justified.

Static analysis

No suspicious patterns detected.