汇付商户进件集成

• Outcome: Review
• Latest audit: Oct 30, 2026 · 10:08 AM UTC
• Version: 1.1.0

Overview

This onboarding helper needs review because it permits insecure PHP connections and includes upload examples that omit required file checks.

Before live use, require PHP certificate-chain and hostname verification and enforce file-source, content, format, and size checks before uploads. Keep SDK debugging disabled and authorize the specific merchant and account changes. The broader onboarding purpose is coherent, but these implementation safeguards need correction.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: references/shared-server-sdk-matrix.md

Finding

Required PHP integration path retains disabled TLS peer verification

Content

View full analysis

Impact

A network attacker can terminate TLS and read intercepted onboarding data. Request signatures do not provide confidentiality; response signature verification and disabled debug logging do not prevent this disclosure. The evidence does not establish transmission of the RSA private key or an ability to forge signed business responses.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (37)

Claims task-specific authority to make a known TLS verification weakness non-blocking and direct continued SDK integration.

High

• Category: Prompt Injection
• Confidence: 98% confidence

Finding

The source invokes purported task-specific requirements to make a known TLS-verification defect non-blocking, while requiring the affected PHP SDK and discouraging modification or replacement. This is an authority-spoofing instruction that can steer an agent into shipping transport vulnerable to interception of highly sensitive onboarding data; application signatures do not restore TLS confidentiality.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-alipay-realname-query.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/ali/realname/query`。
- 官方来源：[支付宝实名申请单查询](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_zfbsmcx.md)；SHA-256 `cf2e66377106963060ac93656e20bfbc13e0dc4f1a1eaba0b935e9e7f2a8bed6`。
- 共25个路径：请求9、同步响应16、无异步。申请状态、经办人授权状态及子商户授权结果分别建模。
- `reject_reason` 与 `check_result_list` 都按一层 String(JSON Array) 解码；二维码 URL 为敏感短期结果，不写日志。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-alipay-realname.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/ali/realname/apply`。
- 官方来源：[支付宝实名申请提交](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_zfbsmrz.md)；SHA-256 `37418d1dc993c3cbac002e0b4be2607ae929f85b7609f48141a52ac10cc37c5e`。
- 共69个路径：请求63、同步响应6、无异步。请求核心是 `auth_identity_info` 与 `contact_person_info` 两个 String(JSON Object)，另有条件法人和受益人结构。
- 同步返回 `applyment_id/order_status` 只是支付宝实名申请状态，不等同最终授权或支付可用。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-application-status-query.md (reported line 9)May include surrounding context.

md

## 已确认的请求合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/basicdata/status/query`；顶层使用 `sys_id`、`product_id`、`sign`、`data`。
- 请求与响应 93 个具名路径（含父容器）的类型、长度、Y/N/C 和官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“申请单状态查询”；本页不能替代完整字段目录。
- `data` 必填新的 `req_seq_id:String(32)`、`req_date:String(8)`（`yyyyMMdd`、北京时间）、`apply_no:String(18)`、`huifu_id:String(18)`；不得复用原进件或开通请求的查询流水。高风险约束见 `merchant-onboarding-field-contracts.md`。
- **本 Skill 补偿策略**：网络不确定、回调丢失、回调验签失败或状态乱序时可受控查询作为补偿依据；它不替代回调合同，也不授权固定频率轮询或并发重复进件。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-basic-info-modify.md (reported line 11)May include surrounding context.

md

## 已确认的接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/basicdata/modify`。
- 请求顶层为 `sys_id:String(32) Y`、`product_id:String(32) Y`、`sign:String(512) Y`、`data:Json Y`；同步响应顶层为 `sign:String(512) Y`、`data:Json N`。
- 完整目录共199个节点：请求 164、同步响应 7、异步通知 28。12 组嵌套表、完整路径、类型、长度、Y/N/C 和官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户基本信息修改”。
- 请求定位字段包括 `data.req_seq_id:String(32) Y`、`data.req_date:String(8) Y`、`data.upper_huifu_id:String(18) C`、`data.huifu_id:String(18) Y`。`upper_huifu_id` 在 `sys_id` 主体为渠道商时填写，总部商户主体时选填。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-business-open-modify.md (reported line 11)May include surrounding context.

md

## 已确认的接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/modify`。
- 请求顶层为 `sys_id:String(32) Y`、`product_id:String(32) Y`、`sign:String(512) Y`、`data:Json Y`。
- 同步响应顶层为 `sign:String(512) Y`、`data:Json N`。
- 完整目录共452个节点：请求 390、同步响应 6、异步通知 56。53 组嵌套表、完整路径、类型、长度、Y/N/C 和经过固定规范化、敏感示例脱敏的官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户业务开通修改”；下载原始字节保存在仓库维护来源锁中，不进入发布包。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-business-open.md (reported line 9)May include surrounding context.

md

## 已确认的请求合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/open`；顶层使用 `sys_id`、`product_id`、`sign`、`data`。
- 官网更新时间 `2026-09-20`；本地活动快照 `2026-10-25`；原文 SHA-256：`9c3f2262c295489abc5ce32bf123128cfd7376c4d5e35399c5083e39ff206c5c`。
- 完整目录共460个节点（请求395、同步响应9、异步56）和 54 组扩展表；全部父子路径、类型、长度、Y/N/C 与官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户业务开通”，本页不能替代完整字段目录。
- `data` 至少需新的当日唯一 `req_seq_id`、`req_date` 和真实 `huifu_id`。`upper_huifu_id:String(18) C`：`sys_id` 主体为渠道商时填写，总部商户主体时选填。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-detail-query.md (reported line 9)May include surrounding context.

md

## 已确认的请求合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/basicdata/query`；顶层使用 `sys_id`、`product_id`、`sign`、`data`。
- 官网更新时间 `2026-10-20`；本地活动快照 `2026-10-25`；原文 SHA-256：`f8fb851eddda3219a5e4feb037b81cc5eed4697903644489e7cccde4fa72bdde`。
- 请求与响应 583 个具名路径（含父容器；请求7、响应576）的类型、长度、Y/N/C 和官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户详细信息查询”；本页的字段白名单策略不能替代完整目录。
- `data` 必填新的 `req_seq_id:String(32)`（当天同商户唯一）、`req_date:String(8)`（`yyyyMMdd`、北京时间）、目标 `huifu_id:String(18)`；高风险约束见 `merchant-onboarding-field-contracts.md`。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-enterprise.md (reported line 9)May include surrounding context.

md

## 已确认的请求合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/basicdata/ent`；顶层包含 `sys_id`、`product_id`、`sign`、`data`。
- 官网更新时间 `2026-09-18`；本地活动快照 `2026-10-25`；原文 SHA-256：`6606629100f94813a7a4238c8f1ffc970ec3b905d1af9487bb92baee6138822e`。
- 请求、同步响应和审核异步的完整父子路径、类型、长度、Y/N/C 与官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“企业商户进件”；本页只保留生成策略和高风险约束，不能替代完整字段目录。
- `data` 的请求定位键为 `req_seq_id`（当日唯一）和 `req_date`（`yyyyMMdd`）。`upper_huifu_id:String(18) C`：`sys_id` 主体为渠道商时填写真实渠道商号，总部商户主体时选填；不得为满足字段而虚构。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-individual.md (reported line 9)May include surrounding context.

md

## 已确认的请求合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/basicdata/indv`；顶层包含 `sys_id`、`product_id`、`sign`、`data`。
- 官网更新时间 `2026-09-04`；本地活动快照 `2026-10-25`；原文 SHA-256：`09862a3923b114abcf7dbc9e7545798481abc37f88b6eb64911ce7d53f9f5437`。
- 请求、同步响应和审核异步的完整父子路径、类型、长度、Y/N/C 与官方说明见 `merchant-onboarding-complete-field-catalog.md` 的“个人商户进件”；本页不能替代完整字段目录。
- `data` 使用当日唯一的 `req_seq_id`、`req_date`。`upper_huifu_id:String(18) C`：`sys_id` 主体为渠道商时填写真实渠道商号，总部商户主体时选填；其余资料按负责人、证件、经营信息、联系人、结算卡、结算/取现规则分组校验。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-multifee-config.md (reported line 11)May include surrounding context.

md

## 已确认的接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/multiFee/config`。
- 请求顶层为 `sys_id:String(32) Y`、`product_id:String(32) Y`、`sign:String(512) Y`、`data:Json Y`；响应顶层为 `sign:String(512) Y`、`data:Json N`。
- 完整目录共27个节点：请求15、同步响应12、无异步通知。完整路径、官网类型、长度、Y/N/C 和说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户多费率配置”。
- 请求定位字段为 `data.req_seq_id:String(32) Y`、`data.req_date:String(8) Y`、`data.huifu_id:String(18) Y`。`req_seq_id` 在同一商户号当天唯一，`req_date` 使用北京时间 `yyyyMMdd`，`huifu_id` 为渠道或一级代理商的直属商户 ID。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-multifee-query.md (reported line 11)May include surrounding context.

md

## 已确认的接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/multiFee/query`。
- 请求顶层为 `sys_id:String(32) Y`、`product_id:String(32) Y`、`sign:String(512) Y`、`data:Json Y`；响应顶层为 `sign:String(512) Y`、`data:Json N`。
- 完整目录共17个节点：请求8、同步响应9、无异步通知。完整路径、官网类型、长度、Y/N/C 和说明见 `merchant-onboarding-complete-field-catalog.md` 的“商户多费率配置查询”。
- 请求定位字段为 `data.req_seq_id:String(32) Y`、`data.req_date:String(8) Y`、`data.huifu_id:String(18) Y`。`req_seq_id` 在同一商户号当天唯一，`req_date` 使用北京时间 `yyyyMMdd`，`huifu_id` 为渠道或一级代理商的直属商户 ID。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-unified-web-query.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/status/query`。
- 官方来源：[统一进件页面版查询](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_shtyjjwebcx.md)；活动 SHA-256 `252db113d3eab2a6de3b1fb27291bc7346f9c2c3a53bcc54657c44cc875357c8`。
- 共51个路径：请求8、同步响应43、无异步。以 `store_id` 查询；`upper_huifu_id:N` 在 `sys_id` 为商户时按原页面请求值传入。
- 返回区分 `check_status`、微信/支付宝支付配置、实名授权和协议信息；任一子状态都不能单独推导“可交易”。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-unified-web.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/url/forward`。
- 官方来源：[商户统一进件（页面版）](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_shtyjjweb.md)；快照 `2026-10-25`；SHA-256 `d3ce5d64bf4c9783b40e0700a93476016b469478ba9b3d2c9adf82f55d1e5888`。
- 共59个路径：请求17、同步响应8、异步34；审核通知和逐业务通知必须分开建模。
- `store_id:String(64) Y` 是本地关联键；`upper_huifu_id:C` 按调用主体填写。`head_office_flag=0` 时文案要求 `head_huifu_id` 必填，`head_office_flag=1` 时禁止传。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-wechat-config.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/config`。
- 官方来源：[微信商户配置](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_wxshpz.md)；SHA-256 `bc0b92c4e46e7a097248cf3e048fcd9f13159b41ccd26194b2825babc132426a`。
- 共31个路径：请求16、同步响应4、异步11。接口只添加配置，官网明确成功后不支持修改或删除，每类参数最多5组。
- `wx_woa_app_id/wx_woa_path/micro_sub_appid/wx_applet_app_id` 四者不能同时为空；APP secret 是高敏凭据，不输出、不落日志。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/merchant-onboarding-wechat-realname.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/merchant/busi/realname`。
- 官方来源：[微信实名认证](https://paas.huifu.com/partners/api/doc/shgl/shjj/api_shjj_wxsmrz.md)；SHA-256 `41d4520a560c4cafb61cf8b87f7d15bf316c949e2b126a131833e343c8fa3197`。
- 共51个路径：请求45、同步响应6、无异步。商户必须已经成功入驻微信；同步成功只返回申请单，不代表实名与授权完成。
- 联系人、受益人、金融机构、特殊主体和材料字段按主体条件执行；标为 N 但说明“企业/经办人/金融机构时必填”的字段仍条件必填。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/onboarding-electronic-contract-resend.md (reported line 5)May include surrounding context.

md

## 接口合同

- Endpoint：`POST https://api.huifu.com/v2/agreement/elect/signurl/resend`。
- 官方来源：[电子合同重发](https://paas.huifu.com/partners/api/doc/shgl/fp/api_fp_dzhtcf.md)；快照 `2026-10-25`；SHA-256 `169b62c666fbe0345ab4f5b10f7f39116d5fd774f6a04ec6abdb77c3923a156e`。
- 共13个路径：请求9、同步响应4、无异步。完整字段见 `onboarding-extension-complete-field-catalog.md`。
- 请求 data 必须包含 `req_seq_id/req_date/huifu_id/agreement_id/sign_user_email`；长度分别为 `32/8/32/32/64`，均为 String Y。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-business-modify.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/busi/modify`。
- 官网更新时间：`2026-10-20`；本地活动快照：`2026-10-25`；原文 SHA-256：`cea918c6a5d5674cdfe22981ffb1066866f40ab4ea649bb312f36fe1296e0cd2`。
- 共151个字段路径：请求104、同步响应11、异步36；6个根表、18个扩展表、21个父节点、130个叶节点。完整字段读取 `user-onboarding-complete-field-catalog.md`。
- `request.data.huifu_id:String(18) Y` 明确使用开户返回的用户号；不得填上级商户号。流水在同一商户号当天唯一，日期为 `yyyyMMdd`。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-business-open.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/busi/open`。
- 快照更新时间：官网 `2026-10-20`，本地冻结 `2026-10-25`；原文 SHA-256：`bef9e9e82e9e0dfc5f4d0445242abfb711fe32195386dd99618366f3110b1191`。
- 共149个字段路径：请求102、同步响应11、异步36；与用户业务入驻修改同为当前九接口中声明异步通知的两个接口。
- 全部请求、同步响应和异步通知的完整父子路径、类型、长度、Y/N/C 与官方说明读取 `user-onboarding-complete-field-catalog.md`；String(JSON)、条件字段和官网冲突同时读取 `user-onboarding-field-contracts.md`。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-enterprise-modify.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/basicdata/ent/modify`。
- 官网更新时间：`2026-09-04`；本地冻结：`2026-10-25`；原文 SHA-256：`bb0b2a7339463d9731243e7d91ec9bfd729180d844646bb119b68655a11a5df8`。
- 共37个字段路径：请求32、同步响应5、异步0；4个根表、1个扩展表、3个父节点、34个叶节点。完整类型、长度、Y/N/C 与说明读取 `user-onboarding-complete-field-catalog.md`。
- 请求定位字段为 `req_date:String(8) Y`、`req_seq_id:String(32) Y`、`huifu_id:String(18) Y`；响应业务字段为 `resp_code:String(8) Y`、`resp_desc:String(512) Y`、`huifu_id:String(18) N`。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-enterprise.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/basicdata/ent`。
- 快照更新时间：官网 `2026-10-21`，本地冻结 `2026-10-25`；原文 SHA-256：`9ae70289683601611a7e9e675c382778e8447b48786ded16a345460ab630c476`。
- 共43个字段路径：请求36、同步响应7、异步0。完整路径、类型、长度、必填性和说明读取 `user-onboarding-complete-field-catalog.md`。
- 请求业务 `data` 不包含 `huifu_id`、`upper_huifu_id` 或异步地址；不得为请求头或 SDK 填充虚构字段。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-individual-modify.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：POST https://api.huifu.com/v2/user/basicdata/indv/modify。
- 官网更新时间：2026-09-04；本地活动快照：2026-10-25；原文 SHA-256：b1495f896cfc12f8e8324c8aa1f97655c0c87d41c626ea636eda54b7b3aa741c。
- 共26个字段路径：请求21、同步响应5、异步0；4个根表、1个扩展表、3个父节点、23个叶节点。完整字段读取 user-onboarding-complete-field-catalog.md。
- 定位字段是 req_seq_id:String(32) Y、req_date:String(8) Y、huifu_id:String(18) Y；流水要求同一商户号当天唯一，日期按北京时间 yyyyMMdd。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-individual.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/basicdata/indv`。
- 快照更新时间：官网 `2026-10-21`，本地冻结 `2026-10-25`；原文 SHA-256：`41f9a75dab6ff2d157ff9f02793afa1ada3baec8f0d67664bed8c1ad08e53bf2`。
- 共34个字段路径：请求27、同步响应7、异步0。完整字段读取 `user-onboarding-complete-field-catalog.md`。
- 请求业务 `data` 没有 `huifu_id`、`upper_huifu_id` 或异步地址。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 50% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/user-onboarding-list-query.md (reported line 9)May include surrounding context.

md

## 接口与字段面

- Endpoint：`POST https://api.huifu.com/v2/user/list/query`。
- 官网更新时间：`2026-09-04`；本地活动快照：`2026-10-25`；原文 SHA-256：`b10ab1529c58d5739cae0f38b5f385a105e3f2d6b3348400f6882328b7421d9d`。
- 共17个完整字段路径：请求8、同步响应9、无异步通知；4个根表、1个扩展表、3个父节点、14个叶节点。完整字段读取 `user-onboarding-complete-field-catalog.md`。
- 请求必填 `legal_cert_no:String(32)`、`req_date:String(8)` 和 `req_seq_id:String(32)`；`upper_huifu_id:String(18) N` 不传时不得自行填充当前用户号或商户号。

The Java upload examples bypass the document's mandatory pre-upload validation gate.

Medium

• Category: Excessive Agency
• Confidence: 97% confidence

Finding

The Java example passes an ordinary caller-provided path directly to the uploading SDK without executing the document's mandatory source, format, content, and size validation gate; the URL example likewise shows no executable validation. Copying these examples can transmit unapproved or oversized material and, if the path is attacker-controlled, local files outside the intended material scope. This is particularly relevant because merchant-onboarding uploads routinely contain sensitive identity and banking documents.

Content

No source excerpt is available for this finding.