Cue 深研

• Outcome: Review
• Latest audit: Sep 18, 2026 · 9:54 AM UTC
• Version: 1.0.2

Overview

The skill is a disclosed Cue research runner, but it can upload local documents to a remote service and run background network jobs in ways that need careful review before installation.

Review this before installing if you handle sensitive documents. Use it only for public or intentionally shared research, confirm every file before upload, avoid passing contracts, internal notes, medical, financial, or proprietary files unless you intend to send them to Cue, and install cue-buddy only from a source you trust because this skill imports its runtime code.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

This is a clear description-behavior mismatch. The declared purpose describes an operational skill that users invoke to perform public-data research via Cue, optionally using buddy templates and saving outputs. The actual code shown is not that runtime skill behavior; it is an internal test suite for the skill. While the tests reference concepts from the declared workflow (template matching, rewrite endpoint, material upload, credits rule, report retrieval), the code's real function is only to assert that documentation and dependent scripts conform to expected contracts. That is a materially different primary purpose, not merely a supporting implementation detail. Therefore the description does not accurately represent this supplied code chunk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest markets the skill as public-data-only, yet the documented workflow supports uploading arbitrary local files as research materials. That creates a data-boundary violation: users or upstream agents may trust the skill for safe public-only research while it can in fact transmit local documents to a remote service, risking exfiltration of sensitive or proprietary content.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 311)May include surrounding context.

md

发起 chat_stream → live 取报告 → 空则 replay 兜底 → 落盘」,**不复制**任何原语(避免与 cue-buddy 版本漂移)。`scripts/test_skill_regression.py` 只做结构/import 自检。**别让 agent 在 prose 里手写 chat_str

Skill Enumeration

Medium

• Category: Agent Snooping
• Confidence: 85% confidence

Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · README.md (reported line 11)May include surrounding context.

md

## Requires cue-buddy alongside

cue-research ships **one thin runtime script** — `scripts/research_run.py` (fire a run → retrieve report → save to file), which *composes* `cue_api` / `sse_report` from the sibling [`../cue-buddy/scripts`](../cue-buddy/scripts) (via a `sys.path` bootstrap; see `SKILL.md`) rather than duplicating them. Install **both skills as sibling folders** under the same parent (e.g. both in `~/.claude/skills/`). Installing cue-research alone will fail at import. (The shared primitives are intentionally *not* copied here, to avoid version drift from cue-buddy.)

`research_run.py` runs in the **background** (SKILL.md launches it with `run_in_background`) and treats **replay as the primary report-retrieval path** — long live SSE streams routinely drop the reporter segment, so it extracts from the live stream and falls back to replay (same parser, reads the full record from the backend DB). Patterns borrowed from the `cuecue-deep-research` sibling skill (async + file output).

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence

Finding

The skill declares capabilities to read environment variables, access the filesystem, write logs/reports, and perform network requests, but does not constrain tool scope with an explicit permissions or allowed-tools policy. In a skill that can upload files, read API keys, and run background networked workflows, missing tool scoping materially increases the blast radius if the skill is misrouted or abused.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

L003 says the skill should be used when the user asks a research question and lists triggers like "帮我查/调研/研究 + 主体或话题," which are common phrases that can appear in ordinary conversation. Although examples are provided, the trigger scope remains broad enough that unrelated requests could plausibly invoke the skill unintentionally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The title and surrounding instructions present the skill as operating in Chinese, and later sections prescribe fixed Chinese user-facing messages. While the file mentions users may speak Chinese or English, it does not clearly offer the user a choice of response language, which can violate locale or language preference policy.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The same persistence concern appears in duplicated analysis output for the main workflow description. The skill normalizes saving completed research and converting runs into reusable templates, which can preserve user intent and derived content longer than expected.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

# cue-research — 让 Cue 在你的 agent 里直接干活

让你在自己的 AI agent 里**用自然语言把一个调研问题交给 Cue**：自动从你的搭子库里匹配 ≤2 个候选(或无合适搭子时改走"带后端 rewrite 的自由式深研")，确认 credits 后执行，跑完满意可以一键沉淀为搭子。本 skill 是 [`cue-buddy`](../cue-buddy) 的兄弟 skill——cue-buddy 负责**做**搭子，cue-research 负责**用**搭子。

## 范围边界(避免起调用前踩坑)

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 78% confidence

Finding

The same persistence concern appears in duplicated analysis output for the main workflow description. The skill normalizes saving completed research and converting runs into reusable templates, which can preserve user intent and derived content longer than expected.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md

# cue-research — 让 Cue 在你的 agent 里直接干活

让你在自己的 AI agent 里**用自然语言把一个调研问题交给 Cue**:自动从你的搭子库里匹配 ≤2 个候选(或无合适搭子时改走"带后端 rewrite 的自由式深研"),确认 credits 后执行,跑完满意可以一键沉淀为搭子。本 skill 是 [`cue-buddy`](../cue-buddy) 的兄弟 skill——cue-buddy 负责**做**搭子,cue-research 负责**用**搭子。

## 范围边界(避免起调用前踩坑)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The table maps broad utterances like "帮我查/调研/研究 <主体或话题>" directly to +ask, but it does not define when these phrases should not activate cue-research. Without negative examples or explicit context limits, these common requests may collide with other general research or assistance behaviors.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The documentation earlier says the agent should avoid backend keyword search and instead fetch all templates and perform its own semantic selection of the top candidates. The sample text shown to users then describes the presented candidates as '关键词匹配', which directly contradicts the intended matching behavior and could mislead implementers about what the code path actually does.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The duplicated finding at this location still reflects a real privacy/security concern: long-lived logs and result files can accumulate sensitive business research context. Because the workflow depends on background monitoring and report retrieval from disk, those artifacts become a meaningful local attack surface.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

找到这些可能合适的搭子(关键词匹配，仅供参考)：
  1. <搭子A 标题> — <一句价值>
  2. <搭子B 标题> — <一句价值>
  0. 都不合适 → 走自由式深度调研(会先经过 /api/rewrite 做隐私脱敏 + 公开信源约束)
  n. 取消

确切 credits 跑完才知道(后端不提供 pre-run 估算，前几次主要用于校准；可在 cuecue.cn 工作台核对)。

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 77% confidence

Finding

The duplicated finding at this location still reflects a real privacy/security concern: long-lived logs and result files can accumulate sensitive business research context. Because the workflow depends on background monitoring and report retrieval from disk, those artifacts become a meaningful local attack surface.

Content

Scanner excerpt · SKILL.md (reported line 119)May include surrounding context.

md

找到这些可能合适的搭子(关键词匹配,仅供参考):
  1. <搭子A 标题> — <一句价值>
  2. <搭子B 标题> — <一句价值>
  0. 都不合适 → 走自由式深度调研(会先经过 /api/rewrite 做隐私脱敏 + 公开信源约束)
  n. 取消

确切 credits 跑完才知道(后端不提供 pre-run 估算,前几次主要用于校准;可在 cuecue.cn 工作台核对)。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

L158 instructs the agent to say a specific Chinese message to the user, and similar mandated Chinese prompts appear elsewhere in the file. Because these prompts are prescribed rather than optional examples, the skill effectively imposes a language choice without explicit user opt-in.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The design relies on conversation IDs, replay, and persisted workflow events in a backend database, and the code delegates privacy de-identification to the agent instead of enforcing it locally. That means sensitive query content may be retained server-side across runs and retrievable later, which is risky in a research skill that is supposed to avoid private-data scenarios.

Content

Scanner excerpt · scripts/research_run.py (reported line 21)May include surrounding context.

python

live stream, and on empty fall back to replay (same parser, reads the
     full workflow_events from the DB — almost always recovers the report).

The rewrite step (free-form privacy de-identification) stays the AGENT's job
per SKILL.md Hard Rules 3/4 — this runner only runs chat_stream + retrieves.
For a buddy run pass --template-id; for a free-form run pass the already
rewritten mandate as --query with no --template-id.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 81% confidence

Finding

Allowing callers to reuse an existing conversation_id enables session continuity and accumulation of prior context on the remote service. In this skill, that persistence is dangerous because it can mix old and new research content, retain potentially sensitive prompts, and undermine the public-data-only boundary if previous context included non-public material.

Content

Scanner excerpt · scripts/research_run.py (reported line 374)May include surrounding context.

python

except (AttributeError, ValueError):
        pass
    p = argparse.ArgumentParser(description=__doc__)
    p.add_argument("--query", required=True, help="问题原文,或自由式已 rewrite 的 mandate")
    p.add_argument("--template-id", default=None, help="搭子模板 id;留空=自由式深研")
    p.add_argument(
        "--conversation-id",

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code can ingest and upload local files both as mimic samples and as research materials, even though the skill description says the workflow should stay within public-data scenarios. This broad local-file access meaningfully increases the attack surface because an agent could be induced to transmit local documents to a third-party service without adequate scope enforcement or data classification.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The runner explicitly supports uploading arbitrary local documents as research materials, which conflicts with the skill's stated public-data-only scope. In an agent setting, this creates a data exfiltration path where local files, including sensitive workspace content, could be sent to a remote research service if the agent or prompt selection is mistaken or manipulated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This code uploads user query content and optionally local files to remote endpoints, but there is no in-code consent or warning mechanism at the point of transmission. In a backgrounded agent workflow, silent transmission is risky because users may believe the skill is only doing public web research, not sending local content or prompts to an external service.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/test_skill_regression.py (reported line 223)May include surrounding context.

python

def test_cue_api_rewrite_exists(self):
        import cue_api
        self.assertTrue(hasattr(cue_api, "rewrite"),
                        "cue_api.rewrite missing — Task 3 not applied?")
        self.assertTrue(callable(cue_api.rewrite))

    def test_cue_api_chat_stream_and_replay_exist(self):

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/test_skill_regression.py (reported line 323)May include surrounding context.

python

import cue_api
        self._last_resp = None

        def fake_urlopen(req, timeout=None):
            self._last_resp = self._FakeResp(frames)
            return self._last_resp

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Multiple user-facing help strings are written only in Chinese, which effectively imposes a specific language on users of this script. There is no indication that the skill is region-specific or that users can opt into a preferred language/locale.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/test_skill_regression.py (reported line 236)May include surrounding context.

python

import cue_api
        for fn in ("upload_file", "get_accept_type"):
            self.assertTrue(hasattr(cue_api, fn), f"cue_api.{fn} missing")
            self.assertTrue(callable(getattr(cue_api, fn)))

    def test_cue_api_has_material_upload_helper(self):
        # 文档接地(素材) needs a file -> file_id SSE upload helper, distinct

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/test_skill_regression.py:376