Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

CueCue Deep Research

Professional AI-powered financial research and analysis tool for market intelligence, industry reports, company analysis, policy impact assessment, competiti...

MIT-0 · Free to use, modify, and redistribute. No attribution required.
2 · 2.2k · 2 current installs · 2 all-time installs
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (financial research) match the declared requirements: Node runtime and a single CUECUE_API_KEY. The homepage (cuecue.cn) and primaryEnv align with the service described. The install entries point to a scoped npm package that would provide the CLI binary expected for this skill.
Instruction Scope
SKILL.md instructs the agent to run the research CLI, monitor its stdout for progress every ~5 minutes, and report progress to users. It does not ask the agent to read unrelated files or additional environment variables, nor to exfiltrate secrets. The long-running nature (5–30 minutes) and instruction to monitor stdout are expected for this kind of task but increase the surface for leaking outputs if not handled carefully.
Install Mechanism
Installation is via an npm package (@sensedealai/cuecue), which is a common and reasonable mechanism for a Node-based CLI. Installing npm packages can execute arbitrary code on the host (postinstall scripts, binaries), so this is a moderate-risk install method but appropriate for a CLI skill. The manifest contains two identical install entries (npm-global and npm-local) — redundant but not necessarily malicious.
Credentials
Only a single API credential (CUECUE_API_KEY) is required and is declared as the primaryEnv. This is proportionate for a remote research/reporting service. No other secrets, config paths, or unrelated credentials are requested.
Persistence & Privilege
The skill is not marked always:true and does not request elevated or persistent platform-wide privileges. It does not instruct modification of other skills or global agent settings. Autonomous invocation is allowed (the platform default) but not combined with other concerning flags.
Assessment
This skill appears coherent with its stated purpose, but take these precautions before installing: - Verify the npm package and its publisher: check the package page (npmjs.com) and the package's source repository to ensure @sensedealai/cuecue is legitimate and maintained. - Review the CLI code if possible (or audit the package contents) before running, since npm installs can execute code on your machine. - Use a dedicated, least-privilege CUECUE_API_KEY (not a general-purpose key) and confirm what permissions and data the key grants; be ready to rotate/revoke it if needed. - Run the install and CLI in an isolated environment (container or VM) if you have concerns about host impact or postinstall scripts. - Expect long-running remote research and a progress URL hosted on cuecue.cn; the skill explicitly tells agents NOT to fetch that URL and to monitor CLI stdout instead — follow that guidance. - If you cannot verify the npm package or the vendor, treat this as higher risk and consider not installing. Confidence is medium because the skill is instruction-only (no local code to scan here) and the actual behavior depends on the remote service and the npm package contents.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.8
Download zip
ai-agentsvk973zhf8cbhj8dekka8d64gxkh804qyadata-analysisvk973zhf8cbhj8dekka8d64gxkh804qyafinancial-analysisvk973zhf8cbhj8dekka8d64gxkh804qyalatestvk97f8tdhx8wffa7kcvwtjvtxdn81ypqbreport-generationvk973zhf8cbhj8dekka8d64gxkh804qyaresearchvk973zhf8cbhj8dekka8d64gxkh804qya

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🔭 Clawdis
OSmacOS · Linux
Binsnode
EnvCUECUE_API_KEY
Primary envCUECUE_API_KEY

Install

Install via npm (global)
Bins: cuecue-research
npm i -g @sensedealai/cuecue
Install via npm (local)
Bins: cuecue-research
npm i -g @sensedealai/cuecue

SKILL.md

CueCue Deep Research Skill

Execute comprehensive financial research queries using CueCue's AI-powered multi-agent system. This TypeScript SDK provides modern async/await patterns, full type safety, and both CLI and programmatic interfaces.

When to Use This Skill

Use CueCue Deep Research for any finance-related investigation, analysis, or reporting needs:

  • Market Research: Stock market analysis, sector trends, market forecasts, and investment opportunities
  • Industry Analysis: Industry landscape studies, competitive dynamics, market structure, and growth projections
  • Company Research: Corporate fundamentals, financial performance, business models, and strategic positioning
  • Policy Impact Assessment: Regulatory changes, government policies, fiscal measures, and their market implications
  • Geopolitical Analysis: International relations, trade policies, regional conflicts, and their economic impact
  • Competitive Intelligence: Competitor analysis, market positioning, product comparisons, and strategic benchmarking
  • Sentiment Analysis: Public opinion tracking, media coverage analysis, and stakeholder perception studies
  • Regional Studies: Geographic market analysis, local economic conditions, and regional investment opportunities

This tool delivers accurate, comprehensive research reports that serve as reliable references for AI agents and financial professionals making data-driven decisions.

何时使用此技能

CueCue 深度研究适用于任何金融相关的调研、分析或报告需求:

  • 市场调研: 股市分析、行业趋势、市场预测和投资机会
  • 行业分析: 行业格局研究、竞争动态、市场结构和增长预测
  • 公司研究: 企业基本面、财务表现、商业模式和战略定位
  • 政策影响评估: 监管变化、政府政策、财政措施及其市场影响
  • 地缘政治分析: 国际关系、贸易政策、区域冲突及其经济影响
  • 竞品情报: 竞争对手分析、市场定位、产品对比和战略基准
  • 舆情分析: 公众舆论追踪、媒体报道分析和利益相关方认知研究
  • 区域研究: 地理市场分析、地方经济状况和区域投资机会

本工具提供准确、全面的研究报告,为智能体和金融专业人士的数据驱动决策提供可靠参考。

What This Skill Does

CueCue Deep Research orchestrates multiple AI agents to:

  1. Analyze your research question and break it down into actionable tasks
  2. Research using web crawling, financial databases, and knowledge retrieval
  3. Synthesize findings into a comprehensive markdown report
  4. Generate a shareable report URL

The skill filters the verbose agent workflow to show only:

  • 📋 Task titles (from the supervisor agent)
  • 📝 Final research report (from the reporter agent)
  • 🔗 Report URL for web viewing

⏱️ Execution Time: Depending on the complexity of your research question, the process may take 5-30 minutes. The system performs comprehensive research including web crawling, data analysis, and report generation. Please be patient and wait for the complete results.

For AI Assistants

Important: When using this skill, you MUST monitor the research progress by checking the command output:

  1. Progress Monitoring: The research process outputs progress information in real-time. You should check the output every 5 minutes to:

    • Verify the research is still running
    • Report task progress to the user (📋 Task updates)
    • Detect any errors or issues
    • Inform the user when report generation begins (📝 Generating Report...)
  2. Progress URL: The command will output a URL like "Research begin. You can view progress at: https://cuecue.cn/c/..." - this URL is for human users to view the web interface, NOT for you to fetch. You should monitor progress through the command's stdout output.

  3. User Communication: Keep the user informed about:

    • When research begins
    • Each major task that starts
    • When report generation begins
    • When research completes
    • Any errors or timeouts
  4. Timeout Handling: If the command appears to hang or timeout, inform the user that the research may still be processing on the server, and they can check the web interface URL.

  5. User-Facing Communication Style: When informing users about progress monitoring:

    • DO SAY: "我会每 5 分钟自动检查进度并汇报" / "I'll check progress every 5 minutes and update you"
    • DO SAY: "研究完成后我会总结关键发现" / "I'll summarize key findings when complete"
    • DON'T SAY: "我创建了一个 cron 任务" / "I created a cron job"
    • DON'T SAY: "完成后会删除 cron" / "Will delete the cron when done"
    • DON'T SAY: Technical implementation details (session IDs, job IDs, internal mechanisms)

    Why: Users care about what you'll do, not how you do it. Keep communication focused on outcomes and user value, not internal plumbing.

Advanced Options

import { CueCueDeepResearch } from '@sensedealai/cuecue';

const client = new CueCueDeepResearch('your-api-key', 'https://cuecue.cn');

const result = await client.research('Company analysis', {
  // Continue existing conversation
  conversationId: 'existing-conversation-id',
  
  // Use a predefined template
  templateId: 'template-id',
  
  // Mimic writing style from URL
  mimicUrl: 'https://example.com/article',
  
  // Enable verbose logging
  verbose: true,
});

Type Definitions

The SDK exports TypeScript types for all interfaces:

import type {
  ResearchOptions,
  ResearchResult,
  SSEEvent,
  RequestPayload,
  AgentStartEvent,
  AgentEndEvent,
  MessageEvent,
  FinalSessionStateEvent,
} from '@sensedealai/cuecue';

Command-Line Options

OptionRequiredDescription
queryResearch question or topic
--api-keyYour CueCue API key (defaults to CUECUE_API_KEY env var)
--base-urlCueCue API base URL (defaults to CUECUE_BASE_URL env var or https://cuecue.cn)
--conversation-idContinue an existing conversation
--template-idUse a predefined research template (cannot be used with --mimic-url)
--mimic-urlURL to mimic the writing style from (cannot be used with --template-id)
--output, -oSave report to file (markdown format). Recommended format: ~/clawd/cuecue-reports/clawd/cuecue-reports/YYYY-MM-DD-HH-MM-descriptive-name.md (e.g., ~/clawd/2026-01-30-12-41-tesla-analysis.md). The ~ will be expanded to your home directory.
--verbose, -vEnable verbose logging
--help, -hShow help message

Output Format

The skill provides real-time streaming output:

Starting Deep Research: Tesla Q3 2024 Financial Analysis

Check Progress: https://cuecue.cn/c/12345678-1234-1234-1234-123456789abc

📋 Task: Search for Tesla Q3 2024 financial data

📋 Task: Analyze revenue and profit trends

📝 Generating Report...

# Tesla Q3 2024 Financial Analysis

## Executive Summary
[Report content streams here in real-time...]

✅ Research complete

============================================================
📊 Research Summary
============================================================
Conversation ID: 12345678-1234-1234-1234-123456789abc
Tasks completed: 2
Report URL: https://cuecue.cn/c/12345678-1234-1234-1234-123456789abc
✅ Report saved to: ~/clawd/cuecue-reports/2026-01-30-10-15-tesla-q3-analysis.md

Troubleshooting

401 Unauthorized

  • Verify your API key is correct
  • Check if the API key has expired
  • Ensure you have necessary permissions

Connection Timeout

  • Verify the base URL is correct
  • Check network connectivity
  • Research queries typically take 5-30 minutes depending on complexity - this is normal
  • If you see a timeout, the research may still be processing on the server - check the web interface

Empty Report

  • Ensure your research question is clear and specific
  • Check server logs for errors
  • Try a different query to test connectivity

Support

For issues or questions:

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…