同花顺CRM伪码批量查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:50 AM UTC
• Version: 1.0.1

Overview

The skill appears intended for a real CRM lookup workflow, but it handles CRM credentials and client certificates in unsafe, overbroad ways that users should review before installing.

Only install or run this skill if you are authorized to access this CRM data and can accept the credential-handling risk. Before use, replace the workflow with one that does not export all Keychain identities, does not write private keys or cookies to predictable /tmp files, does not pass passwords on the command line or in URLs, and does not disable TLS verification.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_query.py:40

Finding

TLS Server Certificate Verification Is Disabled

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:25

Finding

All Exportable Login Keychain Identities Are Exported

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/extract_cert.py:38

Finding

Private Keys Are Extracted Unencrypted and Written Without Enforced Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/batch_query.py:61

Finding

CRM Passwords and Session Cookies Are Exposed Through Unsafe Interfaces

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (39)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared purpose is querying CRM pseudocodes, but the documented behavior also includes exporting identities from the macOS keychain, extracting private keys from PKCS#12, and writing key material to disk. That is materially more sensitive than the user-facing description and can lead to credential exposure or misuse of client certificates.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The referenced keychain operation enables credential export from a trusted local secret store into a less protected file format. Even if intended for legitimate mTLS use, this transforms a protected authentication factor into portable secret material that could be copied or abused.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash

# 导出 HexinCA 根证书并添加为受信任根
security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem

# 导出身份为 PKCS12（会弹出系统对话框，点击"始终允许"）
security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The referenced keychain operation enables credential export from a trusted local secret store into a less protected file format. Even if intended for legitimate mTLS use, this transforms a protected authentication factor into portable secret material that could be copied or abused.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

bash

# 导出 HexinCA 根证书并添加为受信任根
security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem

# 导出身份为 PKCS12（会弹出系统对话框，点击"始终允许"）
security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill combines keychain export with downstream private-key extraction, creating a complete credential-unwrapping workflow. In the context of CRM access, that meaningfully raises the risk of credential theft and unauthorized access because the exported certificate can authenticate as the user.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem

# 导出身份为 PKCS12（会弹出系统对话框，点击"始终允许"）
security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

# 从 PKCS12 提取个人证书+私钥
python3 scripts/extract_cert.py --email <your_email> --p12 /tmp/client_cert.p12 --output /tmp/my_cert.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The skill combines keychain export with downstream private-key extraction, creating a complete credential-unwrapping workflow. In the context of CRM access, that meaningfully raises the risk of credential theft and unauthorized access because the exported certificate can authenticate as the user.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem

# 导出身份为 PKCS12（会弹出系统对话框，点击"始终允许"）
security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

# 从 PKCS12 提取个人证书+私钥
python3 scripts/extract_cert.py --email <your_email> --p12 /tmp/client_cert.p12 --output /tmp/my_cert.pem

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This duplicate finding flags the same unsafe curl parameter. In the context of a CRM skill that authenticates with both a client certificate and password, disabling TLS verification meaningfully increases the chance of credential theft and session compromise.

Content

Scanner excerpt · references/auth_flow.md (reported line 20)May include surrounding context.

Step 1: GET 登录页

text

curl -k --cert ~/my_cert.pem --key ~/my_cert.pem \
  --noproxy '*' -c jar.txt \
  "https://crm.10jqka.com.cn/gb_v3/default/index/login"

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

This duplicate finding flags the same unsafe curl parameter. In the context of a CRM skill that authenticates with both a client certificate and password, disabling TLS verification meaningfully increases the chance of credential theft and session compromise.

Content

Scanner excerpt · references/auth_flow.md (reported line 20)May include surrounding context.

Step 1: GET 登录页

text

curl -k --cert ~/my_cert.pem --key ~/my_cert.pem \
  --noproxy '*' -c jar.txt \
  "https://crm.10jqka.com.cn/gb_v3/default/index/login"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth_flow.md (reported line 121)May include surrounding context.

HexinCA 需添加为受信任根证书（一次性操作）:

bash

security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db assets/hexin_ca.pem

验证:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This duplicate finding points to the same identity-export workflow from the login keychain. The danger is the same: extracting and persisting private key material outside the keychain weakens credential protection and enables impersonation if the files are exposed.

Content

Scanner excerpt · references/auth_flow.md (reported line 135)May include surrounding context.

前置操作（需要用户在系统弹窗点击"始终允许"）:

bash

security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 \
  -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This duplicate finding points to the same identity-export workflow from the login keychain. The danger is the same: extracting and persisting private key material outside the keychain weakens credential protection and enables impersonation if the files are exposed.

Content

Scanner excerpt · references/auth_flow.md (reported line 135)May include surrounding context.

前置操作（需要用户在系统弹窗点击"始终允许"）:

bash

security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 \
  -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/auth_flow.md (reported line 121)May include surrounding context.

md

示例: python3 batch_query.py --cert ~/my_cert.pem --password <你的CRM密码> 11010686 485462305

前置条件:
  1. mTLS 客户端证书已从 macOS Keychain 导出（详见 SKILL.md）
  2. HexinCA 根证书已添加为受信任根
  3. curl 命令行工具可用
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/batch_query.py (reported line 8)May include surrounding context.

python

示例: python3 batch_query.py --cert ~/my_cert.pem --password <你的CRM密码> 11010686 485462305

前置条件:
  1. mTLS 客户端证书已从 macOS Keychain 导出（详见 SKILL.md）
  2. HexinCA 根证书已添加为受信任根
  3. curl 命令行工具可用
"""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/batch_query.py (reported line 104)May include surrounding context.

python

示例: python3 batch_query.py --cert ~/my_cert.pem --password <你的CRM密码> 11010686 485462305

前置条件:
  1. mTLS 客户端证书已从 macOS Keychain 导出（详见 SKILL.md）
  2. HexinCA 根证书已添加为受信任根
  3. curl 命令行工具可用
"""

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/batch_query.py (reported line 10)May include surrounding context.

python

前置条件:
  1. mTLS 客户端证书已从 macOS Keychain 导出（详见 SKILL.md）
  2. HexinCA 根证书已添加为受信任根
  3. curl 命令行工具可用
"""
import subprocess
import re

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script sends the CRM password in the URL query string during login. Query-string credentials can be exposed via process listings, proxy/server logs, browser or intermediary logging, and other telemetry, causing credential disclosure beyond the intended TLS channel.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This duplicate finding points to the same Keychain export guidance that encourages extracting protected identities into portable form. That workflow increases the chance of credential theft, persistence, and unauthorized reuse of the client certificate outside the intended trust boundary.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 9)May include surrounding context.

python

前置条件:
  1. HexinCA 已添加为受信任根证书:
     security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
     security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem
  2. 已从 Keychain 导出 PKCS12 (需要用户在系统弹窗中点击"始终允许"):
     security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This duplicate finding points to the same Keychain export guidance that encourages extracting protected identities into portable form. That workflow increases the chance of credential theft, persistence, and unauthorized reuse of the client certificate outside the intended trust boundary.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 9)May include surrounding context.

python

前置条件:
  1. HexinCA 已添加为受信任根证书:
     security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
     security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem
  2. 已从 Keychain 导出 PKCS12 (需要用户在系统弹窗中点击"始终允许"):
     security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The guidance to add a root certificate as trusted in the user's login keychain modifies local trust settings for the CRM environment. While not malicious on its own, changing trust anchors without strong justification can broaden trust and weaken assurance if users are encouraged to perform it casually.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 10)May include surrounding context.

python

1. HexinCA 已添加为受信任根证书:
     security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
     security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem
  2. 已从 Keychain 导出 PKCS12 (需要用户在系统弹窗中点击"始终允许"):
     security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

用法: python3 extract_cert.py [--email <email>] [--p12 <path>] [--output <path>]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This duplicate finding highlights the same identity-export step from Keychain to a temporary PKCS12 file with a predictable password. In this skill's context, that behavior is especially dangerous because the resulting credential can authenticate to an internal CRM service protected by mutual TLS.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 11)May include surrounding context.

python

security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
     security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem
  2. 已从 Keychain 导出 PKCS12 (需要用户在系统弹窗中点击"始终允许"):
     security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

用法: python3 extract_cert.py [--email <email>] [--p12 <path>] [--output <path>]
示例: python3 extract_cert.py --email <你的邮箱>@myhexin.com --p12 /tmp/client_cert.p12 --output /tmp/my_cert.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

This duplicate finding highlights the same identity-export step from Keychain to a temporary PKCS12 file with a predictable password. In this skill's context, that behavior is especially dangerous because the resulting credential can authenticate to an internal CRM service protected by mutual TLS.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 11)May include surrounding context.

python

security find-certificate -c "HexinCA" -p > /tmp/hexin_ca.pem
     security add-trusted-cert -r trustRoot -k ~/Library/Keychains/login.keychain-db /tmp/hexin_ca.pem
  2. 已从 Keychain 导出 PKCS12 (需要用户在系统弹窗中点击"始终允许"):
     security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "temppass" -o /tmp/client_cert.p12

用法: python3 extract_cert.py [--email <email>] [--p12 <path>] [--output <path>]
示例: python3 extract_cert.py --email <你的邮箱>@myhexin.com --p12 /tmp/client_cert.p12 --output /tmp/my_cert.pem

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This duplicate finding refers to the same error-path guidance that tells the user to export identities from Keychain. Embedding credential-export instructions directly into the tool encourages insecure operational behavior and makes credential extraction seem routine for ordinary CRM tasks.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 46)May include surrounding context.

python

if not pem_data.strip():
    print(f"ERROR: 无法读取 PKCS12 文件 {PKCS12_FILE}")
    print("请先运行:")
    print(f'  security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "{PKCS12_PASS}" -o {PKCS12_FILE}')
    sys.exit(1)

# Split into individual PEM blocks

Credential Access

High

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This duplicate finding refers to the same error-path guidance that tells the user to export identities from Keychain. Embedding credential-export instructions directly into the tool encourages insecure operational behavior and makes credential extraction seem routine for ordinary CRM tasks.

Content

Scanner excerpt · scripts/extract_cert.py (reported line 46)May include surrounding context.

python

if not pem_data.strip():
    print(f"ERROR: 无法读取 PKCS12 文件 {PKCS12_FILE}")
    print("请先运行:")
    print(f'  security export -k ~/Library/Keychains/login.keychain-db -t identities -f pkcs12 -P "{PKCS12_PASS}" -o {PKCS12_FILE}')
    sys.exit(1)

# Split into individual PEM blocks

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill clearly instructs shell execution and file writing, including exporting certificates and saving results, but it declares no tool scope or execution boundaries. This increases the chance an agent can invoke sensitive local operations without explicit permission constraints or user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill automates extraction and storage of CRM-derived customer identifiers/pseudocode data and writes results to a local text file, but it does not provide an explicit warning about handling potentially sensitive customer data. In a CRM context, even pseudocode and phone-related fields may be regulated internal data whose bulk export increases privacy and data-loss risk.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/auth_flow.md (reported line 20)May include surrounding context.

Step 1: GET 登录页

text

curl -k --cert ~/my_cert.pem --key ~/my_cert.pem \
  --noproxy '*' -c jar.txt \
  "https://crm.10jqka.com.cn/gb_v3/default/index/login"

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: references/auth_flow.md:38