skills/sensedeal/cue-skills/cue-buddy/Gen Agent Trust Hub

cue-buddy

Pass

Audited by Gen Agent Trust Hub on Aug 7, 2026

Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONPROMPT_INJECTION
Full Analysis
  • [EXTERNAL_DOWNLOADS]: The skill connects to the official Cue production API at cuecue.cn to manage research templates and run research tasks. It also fetches version metadata and code updates from the author's public GitHub repository at github.com/sensedeal/cue-skills.
  • [COMMAND_EXECUTION]: The update_skill.py and test_skill_regression.py scripts utilize git and other system commands to manage the local environment and verify skill integrity. These operations are limited to standard repository management tasks.
  • [REMOTE_CODE_EXECUTION]: The skill implements a self-upgrade mechanism via the +upgrade command, which allows the agent to pull the latest code updates from the vendor's official repository. This is a documented administrative feature designed to keep the skill synchronized with the backend API.
  • [PROMPT_INJECTION]: The skill features a documentation-intake workflow that processes user-supplied reports and SOPs to generate research templates. This represents an indirect prompt injection surface; however, the skill includes explicit safety guidelines (materials-intake.md) instructing the agent to extract structure only, perform data desensitization, and avoid uploading raw untrusted content to the API.
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 7, 2026, 07:36 AM
Security Audit — agent-trust-hub — cue-buddy