cue-buddy
Pass
Audited by Gen Agent Trust Hub on Aug 7, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill connects to the official Cue production API at
cuecue.cnto manage research templates and run research tasks. It also fetches version metadata and code updates from the author's public GitHub repository atgithub.com/sensedeal/cue-skills. - [COMMAND_EXECUTION]: The
update_skill.pyandtest_skill_regression.pyscripts utilizegitand other system commands to manage the local environment and verify skill integrity. These operations are limited to standard repository management tasks. - [REMOTE_CODE_EXECUTION]: The skill implements a self-upgrade mechanism via the
+upgradecommand, which allows the agent to pull the latest code updates from the vendor's official repository. This is a documented administrative feature designed to keep the skill synchronized with the backend API. - [PROMPT_INJECTION]: The skill features a documentation-intake workflow that processes user-supplied reports and SOPs to generate research templates. This represents an indirect prompt injection surface; however, the skill includes explicit safety guidelines (
materials-intake.md) instructing the agent to extract structure only, perform data desensitization, and avoid uploading raw untrusted content to the API.
Audit Metadata