ClawHub
Back to skill

Security audit

企业-统一信用代码极速查询

Security checks for vulnerabilities and agentic risk

Overview

This enterprise credit-code lookup skill has a coherent purpose, but it sends and logs business query data over plaintext HTTP and its scripts do not match the documented command-line behavior.

Review before installing. This skill may expose searched enterprise names, internal enterprise IDs, and returned company records to an external service and local execution logs, and the traffic is not protected by HTTPS. It should be fixed to use HTTPS, validate responses, redact logs, and implement the documented command-line parameters before use in sensitive business, government, or due-diligence workflows.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
search_ent_simple.py:5
Finding

Enterprise lookup data transmitted over unencrypted HTTP

Content
View full analysis

Vulnerability Details

File Location: search_ent_simple.py:5-8, 26-27; ent_uniform_code.py:5-8, 36-42
Vulnerability Type: Plaintext external API communication
Risk Level: High

Vulnerable Code

search_ent_simple.py:5-8, 26-27

python
config = {
    "host": "http://agent-data.ihdwork.com",
    "base_path": "/handi-ai",
    "endpoint": "/common-api/search-ent"
}

response = requests.get(url, params=params, timeout=10)

ent_uniform_code.py:5-8, 36-42

python
config = {
    "host": "http://agent-data.ihdwork.com",
    "base_path": "/handi-ai",
    "endpoint": "/ent-analysis/uniform-code"
}

response = requests.post(
    url=url,
    headers=headers,
    data=json.dumps(payload, ensure_ascii=False),
    timeout=10
)

Technical Analysis

Both scripts send enterprise lookup information to agent-data.ihdwork.com using plaintext HTTP. The transmitted information includes enterprise names, internal enterprise identifiers, and returned corporate records.

HTTP does not provide transport confidentiality, endpoint authentication, or message integrity. An attacker with access to the network path—such as a malicious wireless access point, compromised proxy, local network attacker, or upstream network operator—can inspect or modify requests and responses.

Because this service supplies data used for enterprise identification and due diligence, response integrity is security-relevant. An attacker could replace the selected enterprise ID or returned uniform credit code without breaking any transport security control.

Attack Path

  1. A user asks the skill to look up an enterprise.
  2. search_ent_simple.py sends the enterprise name as an HTTP query parameter.
  3. A network-positioned attacker intercepts the plaintext request and learns which organization is being investigated.
  4. The attacker modifies the search response to return an attacker-selected enterpris ...[truncated 898 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace the HTTP endpoint with an approved HTTPS production endpoint:
    python
    config = {
    "host": "https://agent-data.example.com",
    "base_path": "/handi-ai",
    "endpoint": "/common-api/search-ent"
}
  2. Retain certificate verification and never set verify=False.
  3. Fail closed if HTTPS is unavailable; do not downgrade automatically to HTTP.
  4. Confirm that the endpoint certificate matches the expected service hostname.
  5. Consider certificate or public-key pinning where the deployment and certificate-rotation model permit it.
  6. Document the external data recipient and ensure transmitting enterprise queries complies with applicable privacy and organizational policies.
  7. Use an approved production service rather than the test-environment address identified by the source-code comment.
  8. Add integration tests that reject non-HTTPS endpoint configurations.

T09 · Insecure Skill Coding Practices

Warning
Location
ent_uniform_code.py:45
Finding

Unvalidated remote responses are treated as successful and written to logs

Content
View full analysis

Vulnerability Details

File Location: ent_uniform_code.py:45-61; related behavior in search_ent_simple.py:29-39
Vulnerability Type: Missing HTTP status and response-schema validation with excessive response logging
Risk Level: Medium

Vulnerable Code

ent_uniform_code.py:45-61

python
print(f"\n状态码: {response.status_code}")
print(f"响应文本: {response.text}")

# 尝试解析JSON
try:
    result = response.json()
    print("\n解析后的JSON响应:")
    print(json.dumps(result, ensure_ascii=False, indent=2))
    
    # 处理返回的数据（可能是直接的字符串或包含在对象中）
    return {
        'data': result,
        'success': True
    }
        
except json.JSONDecodeError:
    # 响应可能是直接的字符串
    print("响应是直接的字符串格式")
    return {
        'data': response.text.strip(),
        'success': True
    }

Related code in search_ent_simple.py:29-39:

python
print(f"状态码: {response.status_code}")
print(f"响应文本: {response.text}")

try:
    result = response.json()
    print("\n解析结果:")
    if isinstance(result, list):
        print(f"共 {len(result)} 条记录")
        for i, item in enumerate(result, 1):
            print(f"{i}. 企业ID: {item.get('ent_id', 'N/A')}, 企业名称: {item.get('ent_name', 'N/A')}")
    else:
        print(json.dumps(result, ensure_ascii=False, indent=2))
    return result

Technical Analysis

The scripts do not call response.raise_for_status() and do not otherwise require an expected successful HTTP status before processing response content.

In ent_uniform_code.py, any syntactically valid JSON value is returned with success: True, regardless of its structure or the HTTP status. If JSON parsing fails, the entire response body is still returned as successful data. Consequently, an HTTP error page, proxy message, malformed service response, or attacker-controlled plaintext response can be interpreted as a successful uniform credit code lookup.

The scripts also print comp ...[truncated 1713 chars]

Remediation
View remediation

Remediation Suggestions

  1. Reject unsuccessful HTTP responses before parsing:
    python
    response.raise_for_status()
  2. Require the expected response content type rather than treating arbitrary plaintext as success.
  3. Validate the response against a strict schema, including required fields and expected data types.
  4. Validate a uniform social credit code before returning success. At minimum, enforce the expected 18-character structure and permitted character set; apply the official checksum algorithm where applicable.
  5. Return success: False for malformed JSON, unexpected schemas, empty values, error statuses, and unsupported response types.
  6. Replace complete response logging with structured, redacted diagnostics such as status code, request correlation ID, and validated result state.
  7. Avoid logging full enterprise records or identifiers unless operationally necessary and explicitly authorized.
  8. Set response-size limits where possible to prevent excessive untrusted content from consuming log or memory capacity.
  9. Add tests for non-2xx statuses, HTML error pages, malformed JSON, missing fields, unexpected JSON types, empty values, and invalid credit-code formats.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The skill instructs the agent to pass enterprise names to underlying scripts and potentially networked services, but it does not disclose to users that their query terms may be transmitted, logged, or processed by external components. In business due-diligence or government招商 contexts, enterprise names can be commercially sensitive, so the lack of transparency can cause unintended data exposure and privacy/compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

This Python file hard-codes user-facing messages, comments, and output formatting in Chinese throughout the skill, with no indication that the language is optional or that the skill is limited to a Chinese-speaking context. That creates a natural-language policy concern because the skill effectively enforces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

All user-facing instructions, examples, and interaction patterns are presented exclusively in Chinese, and the skill does not indicate that language selection is configurable or that Chinese-only operation is a required regional constraint. This can violate a language/locale policy when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.