企查查

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:43 AM UTC
• Version: 1.2.1

Overview

The skill performs company lookups, but it sends searches to an undisclosed Tavily service using an embedded API key, so users should review it before installing.

Install only if you are comfortable with searched company names and related investigative interests being sent to Tavily, not just the Chinese business-information sites named in the documentation. The publisher should disclose Tavily, remove and rotate the embedded API key, remove the unused dependency, and use HTTPS package sources before this is treated as a normal low-risk lookup skill.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: qichacha.js:13

Finding

Hard-Coded Tavily API Credential

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package-lock.json:13

Finding

Unnecessary Dependency Retrieved Through Plaintext HTTP Mirror URLs

Content

View full analysis

= 12" } } ``` The same plaintext mirror pattern appears for `fetch-blob`, `formdata-polyfill`, `node-domexception`, `node-fetch`, and `web-streams-polyfill`. ### Technical Analysis The Skill's executable imports Node.js's native `https` module: ```javascript import https from 'https'; ``` No audited code imports or uses `node-fetch`. Nevertheless, running the documented `npm install` command installs `node-fetch` and its transitive dependency graph. The lockfile identifies package archives with `http://` mirror URLs rather than authenticated `https://` transport. This exposes package retrieval metadata and transport to network interception or mirror manipulation. The lockfile's SHA-512 integrity values provide important protection against a modified archive whose contents do not match the lockfile, but they do not make plaintext transport an appropriate package-distribution configurati ...[truncated 1808 chars]

Remediation

View remediation

other

Warning

• Location: qichacha.js:16

Finding

Undisclosed Transmission of User Queries to Tavily

Content

View full analysis

{ const data = JSON.stringify({ api_key: TAVILY_API_KEY, query: query, max_results: 8 }); const options = { hostname: 'api.tavily.com', port: 443, path: '/search', method: 'POST', headers: { 'Content-Type': 'application/json', 'Content-Length': Buffer.byteLength(data) } }; const req = https.request(options, (res) => { let body = ''; res.on('data', chunk => body += chunk); res.on('end', () => { try { resolve(JSON.parse(body)); } catch (e) { resolve({ results: [], error: e.message }); } }); }); req.on('error', (e) => resolve({ results: [], error: e.message })); req.write(data); req.end(); }); } ``` The user-provided company name is incorporated into four separate search requests: one basic-information request and three intellectual-property requests. The documentation identifies Qichacha, Tianyancha, and similar public sources, but it does not disclose Tavily as the service receiving the queries. ### Technical Analysis A company name supplied on the command line is incorporated into search strings and sent to `api.tavily.com` over HTTPS. The Skill makes one request for basic company information and three additional requests for patent, trademark, and copyright searches. The network transmission is functionally necessary for this implementation, but its destination is not accurately disclosed in `SKILL.md`. The documentation describes information as coming from Qic ...[truncated 2160 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill declares that it queries enterprise information from public company-information platforms such as Qichacha and Tianyancha, but the actual behavior reportedly uses an undeclared third-party network service (Tavily) and a hardcoded API key. This creates a trust and transparency failure: users and operators cannot accurately assess where data is sent, what credentials are embedded, or what external dependencies are invoked, increasing the risk of data leakage, secret exposure, and unauthorized third-party access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation claims the data comes from Qichacha/Tianyancha/Aiqicha public information, while the implemented retrieval path uses Tavily search. This mismatch can mislead users about provenance, privacy, and reliability of business intelligence results, which is especially problematic in compliance or due-diligence contexts.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises Qichacha/Tianyancha-style enterprise lookup, but actually sends user company queries to Tavily, a different third-party service. This is a trust and data-handling issue: users may disclose sensitive targets or investigative interests under a false assumption about where their query is going, and the results may be less authoritative than claimed.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

User-supplied company names are incorporated into search queries and transmitted to Tavily without any user-facing privacy warning or consent step. In corporate, legal, or investigative workflows, the queried entity itself can be sensitive metadata, revealing business strategy, M&A interest, or compliance investigations to an external service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 17)May include surrounding context.

json

"business"
  ],
  "dependencies": {
    "node-fetch": "^3.3.2"
  }
}

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

Natural-language strings, comments, usage text, and output are all Chinese-only, and the skill does not offer the user any language or locale selection. Under the language/locale policy, forcing a single language without opt-in can be a policy violation unless the locale constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.