Skills/ClawHub/cue-cue-lead-pieces

cue-cue-lead-pieces@0.4.31

CAUTION

Publisher claims: "Agent 思考，Cue 感知：用 Cue Omni Reader 把公司自己的披露（A股巨潮/美股SEC EDGAR）解析成带原PDF页码的原文，产出信用线索件，并逐句核对答案引文是否逐字出自所注页±1；--fix 改正页码、换回原句、删掉原文没有的。可选 Cue data-MCP 列公告、cue-research 补背景；未开通 Cue 本地解析兜底。实测（本地解析、单一模型与宿主、24家）：裸Agent引文39%对不上，本件流程95%逐字可查。不适合：投资与信贷建议。Triggers: credit signals, quote verification, 10-K, 年报、引文核对。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · joined 2 days agoInstalls 51Last detonated 23 h ago
Dispute verdict

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only

Static findings

CRITICAL
Access to sensitive file pathsCHANGELOG.md:11 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
npx invocation of non-well-known packageSKILL.md:63 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Python subprocess execution detectedscripts/cue.py:311 · Python subprocess execution detected
AST05
HIGH
npx invocation of non-well-known packageREADME.en.md:99 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:91 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Python subprocess execution detectedscripts/test_skill_regression.py:97 · Python subprocess execution detected
AST05
HIGH
npx invocation of non-well-known packageREADME.en.md:35 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Python subprocess execution detectedscripts/cue.py:83 · Python subprocess execution detected
AST05
CRITICAL
Access to sensitive file pathsCHANGELOG.md:20 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
CRITICAL
Access to sensitive file pathsCHANGELOG.md:12 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files
AST05
HIGH
Python subprocess execution detectedscripts/test_skill_regression.py:135 · Python subprocess execution detected
AST05
HIGH
npx invocation of non-well-known packageREADME.md:35 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.md:99 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageREADME.en.md:91 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packagescripts/cue.py:306 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageCHANGELOG.md:127 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
npx invocation of non-well-known packageSKILL.en.md:52 · npx invocation of non-well-known package — may execute untrusted code
AST06
HIGH
Python subprocess execution detectedscripts/test_skill_regression.py:43 · Python subprocess execution detected
AST05
HIGH
npx invocation of non-well-known packageCHANGELOG.md:247 · npx invocation of non-well-known package — may execute untrusted code
AST06
MEDIUM
File type combined with upload actionSKILL.en.md:62 · File type combined with upload action — agent may exfiltrate local data files
AST07
HIGH
Python subprocess execution detectedscripts/test_skill_regression.py:174 · Python subprocess execution detected
AST05
HIGH
Python subprocess execution detectedscripts/test_skill_regression.py:137 · Python subprocess execution detected
AST05