Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill suspicious because its examples include financial-status checks and company-filings retrieval beyond the stated verification purpose, and show full invoice uploads to an external service without an explicit privacy checkpoint.
Consider the skill's suspicious verdict before installing. Review whether you need the undeclared filings and regulatory-status checks, and do not send a real invoice unless you have confirmed you are comfortable sharing its complete contents with JPVerify.
The supplied example retrieves filings rather than performing a declared verification or validation check. Although filings concern Japanese business data, that broad subject overlap does not disclose this distinct retrieval capability. API-key access and the request to the JPVerify service are ordinary implementation details, not separate mismatches.
The description lists corporate identity, invoice, supplier, address and e-invoice checks, but does not disclose verification of financial regulatory status. The code specifically requests a funds-transfer-business regulatory check, which is distinct from verifying a corporate number. API-key authentication and the request to JPVerify are otherwise consistent supporting implementation details.
The request performs a category-specific regulatory-status check, a capability not disclosed in the declared company, invoice, supplier, address, or e-invoice checks. Although it uses the same provider and a corporate-number identifier, regulatory-status verification is a distinct capability rather than merely an implementation detail of company identity verification.
The request targets corporate filings rather than any of the listed company, invoice, supplier, address, or e-invoice checks. Although filings fall broadly under Japanese business data and the API domain is consistent with JPVerify, retrieving them is a distinct, undeclared capability. Authentication and client-identification headers are ordinary supporting details, not additional mismatches.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
1. **API key (recommended).** If the environment has `JPVERIFY_API_KEY` (a `jpv_live_…` key the user created), send it on every call:
- HTTP: header `Authorization: Bearer $JPVERIFY_API_KEY` (or `X-API-Key`).
- MCP: if the JPVerify Claude Code plugin is installed, the `jpverify` MCP server is already configured and uses the key saved in the plugin's settings (`/plugin` → JPVerify → Configure), not `JPVERIFY_API_KEY`. Otherwise: `claude mcp add --transport http jpverify https://api.jpverify.com/mcp --header "Authorization: Bearer $JPVERIFY_API_KEY" --header "X-JPVerify-Client: jpverify/1.3.0"`
Each successful call is deducted from the user's prepaid USD credits; failed or invalid calls are refunded automatically. Before a large batch, check the balance for free: `GET https://api.jpverify.com/v1/account/balance` with the same header, or the MCP tool `jpverify_balance`.
2. **x402 wallet.** If you have an x402 client with USDC on Base (`eip155:8453`) and the user approved a budge
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
MCP server is already configured and uses the key saved in the plugin's settings (`/plugin` → JPVerify → Configure), not `JPVERIFY_API_KEY`. Otherwise: `claude mcp add --transport http jpverify https://api.jpverify.com/mcp --header "Authorization: Bearer $JPVERIFY_API_KEY" --header "X-JPVerify-Client: jpverify/1.3.0"`
Each successful call is deducted from the user's prepaid USD credits; failed or invalid calls are refunded automatically. Before a large batch, check the balance for free: `GET https://api.jpverify.com/v1/account/balance` with the same header, or the MCP tool `jpverify_balance`.
2. **x402 wallet.** If you have an x402 client with USDC on Base (`eip155:8453`) and the user approved a budget, call without a key: the API answers HTTP 402 with the exact price; sign and retry with `PAYMENT-SIGNATURE`. Pay only within the approved budget.
3. **Neither.** Do not pay and do not invent a key. The MCP server also works without a key for the free tool `jpverify_guide` (`claude mcp
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
deducted from the user's prepaid USD credits; failed or invalid calls are refunded automatically. Before a large batch, check the balance for free: `GET https://api.jpverify.com/v1/account/balance` with the same header, or the MCP tool `jpverify_balance`.
2. **x402 wallet.** If you have an x402 client with USDC on Base (`eip155:8453`) and the user approved a budget, call without a key: the API answers HTTP 402 with the exact price; sign and retry with `PAYMENT-SIGNATURE`. Pay only within the approved budget.
3. **Neither.** Do not pay and do not invent a key. The MCP server also works without a key for the free tool `jpverify_guide` (`claude mcp add --transport http jpverify https://api.jpverify.com/mcp`); use it to confirm which call fits, then tell the user they can create a free account with starter credit at https://www.jpverify.com/signup?ref=jpverify and set `JPVERIFY_API_KEY`.
Always send `X-JPVerify-Client: jpverify/1.3.0` on HTTP calls. Never print, log or share the API key.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API key:
curl -X POST https://api.jpverify.com/v1/jp/companies/resolve \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/companies/resolve",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"name": "Murata Manufacturing Co., Ltd.", "prefecture": "Kyoto"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# No key: shows the HTTP 402 x402 price; pay with an x402 client and retry with PAYMENT-SIGNATURE.
curl -i -X POST https://api.jpverify.com/v1/jp/companies/resolve \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
-d '{"name": "Murata Manufacturing Co., Ltd.", "prefecture": "Kyoto"}'
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /v1/jp/suppliers/resolve — $0.10curl -X POST https://api.jpverify.com/v1/jp/suppliers/resolve \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/suppliers/resolve",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"name": "株式会社ABC", "registration_number": "T1013301046627", "response_language": "both"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /v1/jp/addresses/normalize — $0.005curl -X POST https://api.jpverify.com/v1/jp/addresses/normalize \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/addresses/normalize",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"address": "東京都新宿区西新宿2丁目8番1号", "response_language": "both"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /v1/jp/addresses/parse — $0.005curl -X POST https://api.jpverify.com/v1/jp/addresses/parse \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/addresses/parse",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"address": "東京都千代田区千代田1丁目1番1号", "response_language": "ja"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /v1/jp/addresses/geocode — $0.005curl -X POST https://api.jpverify.com/v1/jp/addresses/geocode \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/addresses/geocode",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"address": "東京都千代田区千代田1丁目1番1号", "max_candidates": 3},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
POST /v1/jp/addresses/validate — $0.005curl -X POST https://api.jpverify.com/v1/jp/addresses/validate \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/addresses/validate",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
json={"address": "東京都千代田区千代田1丁目1番1号", "required_level": 8, "strict": False},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
# No key: shows the HTTP 402 x402 price; pay with an x402 client and retry with PAYMENT-SIGNATURE.
curl -i -X POST https://api.jpverify.com/v1/batch-jobs \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Authorization: Bearer REPLACE_WITH_YOUR_OWN_RANDOM_TOKEN_32_CHARS_OR_MORE" \
-H "Idempotency-Key: my-batch-job-0001" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
API key:
curl -X POST https://api.jpverify.com/v1/jp/companies/resolve \
-H "Authorization: Bearer $JPVERIFY_API_KEY" \
-H "X-JPVerify-Client: jpverify/1.3.0" \
-H "Content-Type: application/json" \
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/companies/resolve",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/companies/resolve",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
import os, requests
response = requests.post(
"https://api.jpverify.com/v1/jp/suppliers/resolve",
headers={"Authorization": f"Bearer {os.environ['JPVERIFY_API_KEY']}",
"X-JPVerify-Client": "jpverify/1.3.0"},