cue-skills (cue-omni-reader-guard)
sensedeal/cue-skills/dsh/cue-omni-reader-guard
面向 DeepSeek Harness 的 mcp__omni__parse 加固护栏:tools/pre-execute 监听器拒绝私网/保留主机(SSRF),施加白名单或 ask(同意),allowedRoots 为空时 fail-closed。
安装
dsh plugin --profile web add github:sensedeal/cue-skills该插件位于仓库的 dsh/cue-omni-reader-guard 子路径下。
README
cue-skills
Open-source agent skills published by Cue (sensedeal).
A skill is a portable instruction bundle that any AI agent (Claude Code, Codex CLI, Gemini CLI, …) can load to gain a new capability — without modifying the agent itself. This repo collects the skills Cue maintains for public use.
DSH users: install the Cue Omni Reader bundles
Running DeepSeek Harness? Add the two Cue bundles to a profile and get Cue Omni Reader as native mcp__omni__* tools:
dsh plugin --profile web add @cueai/dsh-omni-reader
dsh plugin --profile web add @cueai/dsh-omni-reader-guard # optional SSRF/consent guard
Restart dsh; the model then sees mcp__omni__parse / …get_parse_status / …read_result / …read_outline / …save_result / …cancel_parse / …discard_result. Set CUE_API_KEY (+ optional OMNI_ALLOWED_ROOTS) via $DSH_HOME/.env. Guide: dsh/ · usage.md.
DSH bundles
This repo also ships DeepSeek Harness bundles under dsh/ — thin composition packages that wire a Cue MCP server into a DSH profile so its tools surface natively (e.g. mcp__omni__parse). A skill is agent-loadable instructions; a bundle is a composition package (package.json + cordis.patch.yml) for the Harness. Install one with dsh plugin --profile web add <pkg>; see dsh/README.md and the cue-omni-reader bundle.
Skills in this repo
| Skill | Purpose | Status |
|---|---|---|
cue-buddy/ — cue-buddy | Lets business experts author, validate, test, tune, and pin-as-frequent Cue "buddy" research templates via natural conversation. No Python / API knowledge needed; the agent talks to the Cue production API on the user's behalf. | v0.3.6 |
cue-research/ — cue-research | Sibling to cue-buddy for using Cue from inside your AI agent: ask a question → skill matches ≤2 candidate buddies (or routes to free-form deep research via /api/rewrite) → you confirm credits → it runs in the background and retrieves the report via replay → on satisfaction you can distill a free-form run into a saved buddy via cue-buddy. Supports 仿写/mimic (imitate a reference URL or sample document's writing style). | v0.3.6 |
cue-omni-reader/ — cue-omni-reader | Helps external agents parse HTTP(S) URLs and authorized local documents, audio, or video through the official MCP tools, including safe Bridge bootstrap, recoverable operations, content-only client compatibility, complete artifact reading, and cleanup. Thin instruction layer; no custom parser or protocol driver. | v0.3.6 |
cue-data-mcp/ — cue-data-mcp | Lets external agents query Cue's public MCP data services (regulatory, macro, disclosures, market data, legal full text, holdings, entity data, academic, IPO, ESOP, buyback, footnote details) by discovering live domains from the anonymous /api/mcp-catalog and connecting through each domain's routing DTO. Thin instruction layer; no hardcoded endpoints or tool names. | v0.3.6 |
playbook/ — playbook scene skills | One agent-loadable SKILL.md per Cue playbook scene (equity research, credit diligence, wealth advisory, global macro, …). Load one and your agent runs that scenario's Cue deep research: it queries the live /api/playbook for the scene's current buddies, picks one, confirms credits, runs, and returns a source-cited report. Runtime-query-live — no baked template_id, so buddy add/edit/remove auto-reflects with no regeneration. Auto-generated by scripts/gen_scene_skills.py. Works two ways: bundled here next to cue-research/cue-buddy, or published standalone to a third-party store — a standalone scene skill self-bootstraps (clones this repo, with a Gitee mirror fallback, to fetch the runner if not already present). | auto-generated |
More skills will be added here as Cue's surface grows.
What is Cue / What is a buddy
Cue is a Deep Research Agent + Intelligence Sentinel platform for high-precision finance and business workflows. It picks tools from 300+ professional data sources (A-share / HK / US equity disclosures, fund AMAC registries, business registries, court records, regulatory feeds, sell-side research, capital flow data), cross-validates findings across sources, and produces structured, source-cited reports in minutes instead of hours.
A "buddy" (搭子) is a research playbook for a specific scenario — corporate-credit pre-diligence, public-record compliance snapshot, quarterly earnings review, private-fund manager DD, etc. — defined once and reused by supplying the subject. The cue-buddy skill in this repo is what business experts use to author these playbooks conversationally.
Scope boundary: Cue's tool surface covers public data sources only (equity disclosures / business registries / court records / regulatory filings / capital flows / etc.). Scenarios requiring private data (real AML on bank-internal transactions, medical diagnosis, internal accounting) are not appropriate as Cue buddies — the supervisor cannot route them and falls back to generic web search.
cue-buddy +authorflow calls+capabilitiesto cross-check each declared evidence source against the actual catalog before persisting a template.
See cue-buddy/README.md for the full skill walkthrough.
Using a skill
cue-buddy is self-contained: an entrypoint SKILL.md, supporting references/, and stdlib-only scripts/. cue-research ships no runtime scripts of its own — it reuses cue-buddy's (cue_api / sse_report), so it must be installed alongside cue-buddy as a sibling folder.
Claude Code: copy the skill folder into ~/.claude/skills/ or reference it via /use-skill <path>. See per-skill README for exact installation. For cue-research, install cue-buddy next to it (same parent dir) so its shared scripts resolve.
Other agents: load <skill>/SKILL.md as a system instruction. The skill's scripts are stdlib-only Python where possible.
cue-omni-reader ships no runtime parser scripts. Load its SKILL.md and connect an official Omni MCP surface. Existing URL tools need no local install; local files use the audited Bridge after minimum-root confirmation.
cue-data-mcp ships no runtime code. Load its SKILL.md and let the agent discover the live data domains from the anonymous /api/mcp-catalog, then connect through each domain's routing DTO. Self-contained: no sibling folders required.
The playbook/ scene skills delegate the actual research run to cue-research's runner, which in turn reuses cue-buddy's scripts — so install all three (playbook/<scene>, cue-research, cue-buddy) as siblings under the same parent dir.
Free credits to try: every Cue account comes with free credits — 50 on first sign-up, plus 10 free every day. So once you apply for an API key (sign in via the
cueCLI), you can run deep research on the free tier before spending anything. Each deep-research run still consumes credits; the skills always confirm with you before spending.
Contributing
Bug reports and skill suggestions: open an issue.
Pull requests welcome. Each skill has its own hard-rules / validator; see the skill's README for contribution guidelines.
License
MIT — see LICENSE. Skill content is free to use, modify, and redistribute.