Security audit

laiye-doc-processing

Security checks for vulnerabilities and agentic risk

Overview

This document-processing skill is mostly purpose-aligned, but its install instructions ask agents/users to run mutable remote installer scripts and unpinned global packages, which creates a real host-execution supply-chain risk.

Review before installing. Prefer a pinned, verified package or inspect and verify installer scripts before running them, avoid running the installer with elevated privileges, and do not upload financial, HR, identity, or confidential documents unless you are authorized to send them to Laiye's ADP service. Treat API keys as secrets and avoid placing real keys directly in shell commands or agent logs.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

Location: references/examples.md:14
Finding: Unverified Mutable Remote Installation Scripts Are Executed Directly
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/examples.md:11
Finding: Unpinned CLI Package Is Installed Globally Through Multiple Registries
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/examples.md:86
Finding: API Keys Are Accepted Through Exposed Command-Line Arguments
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (30)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The | bash construct is dangerous because it chains network retrieval directly into shell execution, collapsing fetch and execute into one step and preventing review, sandboxing, or validation. In an agent skill README, this is more dangerous because users may copy-paste it blindly or automation may operationalize it, turning documentation into an easy code-execution vector.
Content: Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用） curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用） Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · README.md (reported line 48)May include surrounding context.
md
agentic-doc-parse-and-extract/ ├── skill.md # Skill configuration and invocation instructions ├── README.md # Introduction to Laiye ADP product and instructions for CLI download and invocation ├── references/ # Parameter enumeration, error codes, and JSON return instructions ├── examples.md # Sample code for invocation and return with parameter explanations ├── commands.md # List of all commands ├── response-schema.md # Return parameter description

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The use of a pipeline into bash is a chaining pattern that removes the inspection boundary between download and execution, making exploitation straightforward if the remote content changes maliciously. Because this skill targets AI-agent and automation usage, the chaining pattern increases the chance that setup is performed non-interactively and without human scrutiny.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
md
export PATH="$(npm prefix -g)/bin:$PATH" # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: Using curl ... | bash chains network retrieval directly into shell execution, removing any opportunity for inspection or integrity validation. In an agent context, this is especially dangerous because automated systems may execute the chain blindly, enabling immediate remote code execution if the source is compromised or substituted.
Content: Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code from the network immediately. If the GitHub account, repository, branch, CDN path, or transport chain is compromised, users and agents could run attacker-controlled commands with local user privileges without any verification step.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The Windows install flow downloads a PowerShell script to a temp path and executes it immediately, again with no opportunity for review or integrity verification. This creates a remote code execution path if the hosted script is modified maliciously or intercepted through a compromised upstream source.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code from the network immediately. If the upstream repository, delivery path, or maintainer account is compromised, users and agent-driven workflows could execute arbitrary commands on the host with the user's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The PowerShell example downloads a remote script and immediately executes it without integrity verification or review. This creates the same arbitrary code execution risk on Windows systems, especially dangerous in enterprise environments where agents may follow installation instructions automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill instructs users and agents to upload local files or provide document URLs to a remote document-processing service, but it does not prominently warn that the full contents of those documents may contain sensitive personal, financial, HR, or identity data that will be transmitted to a third party. In this context, the omission is important because the skill explicitly targets invoices, receipts, orders, and Chinese identity documents, all of which commonly contain regulated or highly sensitive information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a skill for parsing documents and extracting key information, but this command reference also exposes config operations for setting/clearing API credentials and base URLs, which are administrative capabilities rather than document-processing behavior. This broadens the skill beyond the stated parsing/extraction workflow in a meaningful way.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 36)May include surrounding context.
md
| Option | Type | Description | |--------|------|-------------| | `--force`, `-y` | boolean | Skip confirmation prompt | ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: These commands allow local files or folders to be parsed by a remote service but provide no explicit warning that document contents may be uploaded off-host. Because the skill targets invoices, receipts, IDs, and credential documents, silent transmission can expose highly sensitive personal, financial, or corporate data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The extraction workflow similarly processes local documents without warning users that sensitive contents may be transmitted to an external service for structured field extraction. Given the skill's business and identity-document use cases, this omission increases the chance of privacy violations, data leakage, and noncompliant handling of regulated information.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This section exposes full custom application lifecycle management, including create, update, delete, and AI-generated configuration, which materially expands the skill beyond simple document parse/extract usage. In an agent context, these commands could let the model alter persistent server-side extraction apps or delete configurations, creating integrity and availability risks if invoked unintentionally or through prompt manipulation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The installation guidance includes executing remote shell/PowerShell scripts without warning about trust boundaries, host impact, or verification steps. In the context of an agent-consumable skill, such examples normalize unsafe execution patterns and could lead to silent compromise of the machine running the agent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation instructs users/agents to install the CLI by executing remotely fetched shell and PowerShell scripts. This gives an external endpoint direct code execution on the host, which is unnecessary for a document-parsing skill and creates a supply-chain/RCE risk if the source, transport, or repository is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The guide tells users to set an API key but does not disclose where or how the credential is stored, nor the local exposure implications. This can lead to secrets being persisted in plaintext or broadly accessible config locations without user awareness, increasing the chance of credential leakage.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples send local documents and URLs to a remote parsing/extraction service without an explicit privacy or data-transfer warning. Because the skill handles invoices, receipts, identity documents, and other sensitive records, undisclosed transmission can expose regulated or confidential data to external systems.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 93% confidence
Finding: The command fetches executable content from an external URL at install time, introducing supply-chain risk and trust on mutable remote content. In this skill context, installation instructions may be followed by AI-assisted users or automation, increasing the chance that remote code is executed without human scrutiny.
Content: Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用） curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用） Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

External Script Fetching

Low

Category: Supply Chain
Confidence: 96% confidence
Finding: This is a concrete instance of external script fetching followed by immediate execution. In the context of an agent skill for document processing, this is more dangerous because automated systems may treat README commands as trusted setup instructions, turning documentation into an execution vector.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
md
export PATH="$(npm prefix -g)/bin:$PATH" # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 10)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 14)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 22)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 32)May include surrounding context.
md
4. Disclaimer of Warranties THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT. 5. Termination

External Script Fetching

Low

Category: Supply Chain
Confidence: 98% confidence
Finding: Fetching an installation script from an external URL and immediately executing it introduces a classic supply-chain risk. If the remote content or distribution channel is tampered with, arbitrary code runs with the user's privileges on the local system.
Content: Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Static analysis

No suspicious patterns detected.