ClawHub
Back to skill

Security audit

Adp Skill

Security checks for vulnerabilities and agentic risk

Overview

This is a documented external document-processing API guide, with expected user-directed uploads and credential use rather than hidden local execution or persistence.

Before installing, confirm your organization permits sending invoices, receipts, purchase orders, or other business documents to Laiye's external ADP service. Use scoped credentials where possible, avoid highly sensitive PII until retention and deletion terms are reviewed, and prefer environment variables or a secret store for keys.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (12)

Credential Access

High
Category
Privilege Escalation
Content
# Recommended: Every 90 days

# 4. Never commit credentials to git
echo "*.env" >> .gitignore
echo "openclaw.json" >> .gitignore
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High
Category
Privilege Escalation
Content
# Recommended: Every 90 days

# 4. Never commit credentials to git
echo "*.env" >> .gitignore
echo "openclaw.json" >> .gitignore
```
Confidence
60% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High
Category
analysis-evasion
Content
- [ ] No credentials or secrets are embedded in `SKILL.md` or `package.json`
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The quick-start example instructs users to send both document references and authentication material to a third-party SaaS endpoint, but the surrounding text does not prominently disclose that business documents will leave the local environment for external processing. In an enterprise document-processing context, this can cause unintentional exposure of invoices, receipts, or other sensitive records if users assume the skill operates locally or within their own platform boundary.

External Transmission

Medium
Category
Data Exfiltration
Content
### 从发票提取数据

```bash
curl -X POST "https://adp.laiye.com/open/agentic_doc_processor/laiye/v1/app/doc/extract" \
  -H "Content-Type: application/json" \
  -H "X-Access-Key: $ADP_ACCESS_KEY" \
  -H "X-Timestamp: $(date +%s)" \
Confidence
95% confidence
Finding
The example performs a POST to an external API endpoint and includes access credentials plus a document URL, which means document data or pointers to sensitive documents are transmitted off-system. In this skill's context, the entire product is a remote document-processing service, so external transmission is expected, but it is still security-relevant because enterprise users may process confidential financial documents.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The README provides a copy-paste example that sends both a document URL and API credentials to a third-party endpoint, but it does not explicitly warn users that document contents may contain sensitive business or personal data and will be transmitted off-platform. In an agent-skill context, this omission increases the risk of accidental disclosure because users may treat the integration as local or platform-native rather than an external SaaS call.

External Transmission

Medium
Category
Data Exfiltration
Content
### Extract Data from an Invoice

```bash
curl -X POST "https://adp-global.laiye.com/open/agentic_doc_processor/laiye/v1/app/doc/extract" \
  -H "Content-Type: application/json" \
  -H "X-Access-Key: $ADP_ACCESS_KEY" \
  -H "X-Timestamp: $(date +%s)" \
Confidence
84% confidence
Finding
This example instructs users to POST document references and authentication material to an external API endpoint. While external transmission is core to the product, the security issue is that the README normalizes exfiltration of potentially sensitive documents to a remote service without strong disclosure, minimization guidance, or guardrails.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
export ADP_APP_SECRET="your_key"

# 2. Set restrictive file permissions
chmod 600 ~/.openclaw/openclaw.json

# 3. Rotate credentials regularly
# Recommended: Every 90 days
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
export ADP_APP_SECRET="your_key"

# 2. Set restrictive file permissions
chmod 600 ~/.openclaw/openclaw.json

# 3. Rotate credentials regularly
# Recommended: Every 90 days
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
## Quick Start

```bash
curl -X POST "https://adp-global.laiye.com/open/agentic_doc_processor/laiye/v1/app/doc/extract" \
  -H "Content-Type: application/json" \
  -H "X-Access-Key: $ADP_ACCESS_KEY" \
  -H "X-Timestamp: $(date +%s)" \
Confidence
91% confidence
Finding
The skill instructs users to send documents and authentication material to an external third-party service. This creates a real data-exfiltration and trust-boundary risk because potentially sensitive enterprise documents are transmitted off-platform for processing, even though the documentation openly discloses this behavior.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Content
```

**Security Note:**
- Set file permissions: `chmod 600 ~/.openclaw/openclaw.json`
- Never commit this file to version control
- Prefer environment variables or secret stores
- Rotate credentials regularly
Confidence
80% confidence
Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

External Transmission

Medium
Category
Data Exfiltration
Content
# Convert file to base64
file_base64=$(base64 -i document.pdf | tr -d '\n')

curl -X POST "https://adp-global.laiye.com/open/agentic_doc_processor/laiye/v1/app/doc/extract" \
  -H "Content-Type: application/json" \
  -H "X-Access-Key: $ADP_ACCESS_KEY" \
  -H "X-Timestamp: $(date +%s)" \
Confidence
94% confidence
Finding
This example shows base64-encoding a local document and embedding its full contents in a request body to an external API. That is a genuine external transmission risk because local file contents, which may include sensitive business or personal data, are sent to a remote service and may be exposed through intermediary logging or third-party retention.

Static analysis

No suspicious patterns detected.