Cue 深研

• Outcome: Review
• Latest audit: Aug 11, 2026 · 10:43 AM UTC
• Version: 1.0.1

Overview

This skill is mostly transparent about using Cue for research, but it expands from public-data research into uploading local documents and self-updating from a remote branch, which needs Review before installation.

Install only if you are comfortable sending selected prompts, uploaded sample/material files, and research context to Cue's backend. Do not use it for private AML, medical, internal accounting, confidential contracts, or other sensitive documents unless you have reviewed Cue's handling and explicitly intend to upload them. Review the update behavior before allowing +upgrade or silent update checks.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill clearly instructs the agent to use environment variables, read and write local files, and make network requests, yet the manifest declares no permissions. That creates a transparency and policy-enforcement gap: a host may auto-load or authorize the skill without understanding that it can access secrets, persist data, and exfiltrate content to a remote API.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The self-upgrade verb allows the skill to modify its own codebase by pulling from a remote GitHub main branch, which is unrelated to answering research queries. Self-modifying behavior expands the trust boundary and can turn a benign skill into a delivery path for supply-chain compromise or unexpected capability changes after installation.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The manifest and description claim a public-data-only scope, but the skill later supports uploading arbitrary local documents as research material. That directly widens the data boundary from public sources to user-local potentially sensitive files, creating a risk of accidental exfiltration of confidential documents to the external Cue service under a misleading safety model.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The runner imports and exposes file-upload primitives (`upload_file`, `upload_material`) even though the skill metadata says the research scope is public-data only. This creates a real data-boundary mismatch: an agent or user can send local document contents to the remote Cue service, including sensitive files, despite the manifest framing suggesting such inputs should be refused.

Description-Behavior Mismatch

Medium

• Confidence: 98% confidence
• Finding: The `--material` option explicitly supports uploading arbitrary local documents as grounding material for research. In the context of a skill whose declared scope is limited to public-data research, this is a direct capability expansion that can exfiltrate non-public local data to an external service.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code uploads local files provided via `--mimic-file` or `--material` to a remote service without any built-in user-facing warning, sensitivity screening, or confirmation step at the point of transmission. In an agent setting, this is dangerous because users may assume files are processed locally or within the skill's stated public-data boundaries, causing accidental disclosure of confidential documents.

Session Persistence

Medium

• Category: Rogue Agent

Content

# cue-research — 让 Cue 在你的 agent 里直接干活

让你在自己的 AI agent 里**用自然语言把一个调研问题交给 Cue**：自动从你的搭子库里匹配 ≤2 个候选(或无合适搭子时改走"带后端 rewrite 的自由式深研")，确认 credits 后执行，跑完满意可以一键沉淀为搭子。本 skill 是 [`cue-buddy`](../cue-buddy) 的兄弟 skill——cue-buddy 负责**做**搭子，cue-research 负责**用**搭子。

## 范围边界(避免起调用前踩坑)

• Confidence: 88% confidence
• Finding: The skill is designed to persist research artifacts and derived templates across sessions, including saving reports to disk and optionally turning prior conversations into reusable buddies. Persistent storage increases privacy and retention risk because sensitive or user-specific research content may remain on disk beyond the immediate task and be reused in later contexts.

Session Persistence

Medium

• Category: Rogue Agent

Content

live stream, and on empty fall back to replay (same parser, reads the
     full workflow_events from the DB — almost always recovers the report).

The rewrite step (free-form privacy de-identification) stays the AGENT's job
per SKILL.md Hard Rules 3/4 — this runner only runs chat_stream + retrieves.
For a buddy run pass --template-id; for a free-form run pass the already
rewritten mandate as --query with no --template-id.

• Confidence: 88% confidence
• Finding: The runner deliberately relies on prior agent-side de-identification and then persists conversation state and replayable workflow events remotely. If the agent fails to rewrite or sanitize correctly, sensitive user content can be retained in `conversation_id` history and backend workflow storage, making privacy protection dependent on external process discipline rather than code enforcement.

Session Persistence

Medium

• Category: Rogue Agent

Content

except (AttributeError, ValueError):
        pass
    p = argparse.ArgumentParser(description=__doc__)
    p.add_argument("--query", required=True, help="问题原文,或自由式已 rewrite 的 mandate")
    p.add_argument("--template-id", default=None, help="搭子模板 id;留空=自由式深研")
    p.add_argument(
        "--conversation-id",

• Confidence: 91% confidence
• Finding: The `--conversation-id` option allows reuse of an existing remote conversation, which can cause cross-run session persistence and context bleed between separate research tasks. In an agent environment, this increases the risk that prior prompts, uploaded materials, or sensitive context are retained and influence later runs or remain accessible longer than intended.

Static analysis

Detected: suspicious.obfuscated_code

Potential obfuscated payload detected.

Warn

• Code: suspicious.obfuscated_code
• Location: scripts/test_skill_regression.py:376