Bank Card Origin Query - 银行卡归属地查询

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:00 AM UTC
• Version: 1.0.4

Overview

The skill does what it claims, but it sends full bank card numbers and an API key to a third-party service in URL query parameters without a clear privacy warning.

Review before installing if you will process real card numbers. Use a dedicated low-privilege JisuAPI key, avoid submitting card numbers unless the user explicitly agrees, and be aware that the remote provider or network infrastructure may retain URL query logs containing the key and card number.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: bankcard.py:29

Finding

API Credential and Bank Card Number Exposed in URL Query Parameters

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares environment and implied network use in metadata, but does not define an explicit tool scope such as allowed tools or permissions. That weakens the trust boundary for the agent/runtime and can lead to over-broad execution or unclear authorization around external requests and secret access. In this skill, that matters because it reads an API key from environment variables and sends user-supplied bank card numbers to a third-party service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill handles highly sensitive financial data but does not warn that submitted card numbers are transmitted to JisuAPI, a third-party service. This creates a privacy and compliance risk because users or calling agents may disclose full bank card numbers without informed consent, and the data leaves the local trust boundary.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · bankcard.py (reported line 14)May include surrounding context.

python

import requests


BANKCARD_QUERY_URL = "https://api.jisuapi.com/bankcard/query"


def query_bankcard(appkey: str, req: dict):

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill sends a full bank card number to a third-party API service, which is sensitive financial data and may be subject to privacy, compliance, or data-handling risks. The code provides no user-facing disclosure, consent mechanism, masking, minimization, or documentation of how card data is shared, retained, or protected by the external provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The activation description and the rest of the skill documentation are written entirely in Chinese and frame invocation around Chinese user utterances, but the file does not state that the skill is intentionally limited to Chinese-language use or offer an alternative language option. This can be a natural-language locale policy issue when a skill implicitly forces one language without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The natural-language descriptions and usage text are written in Chinese, which can impose a locale preference on users without opt-in. The file does not indicate that the skill is region-specific or provide any language selection mechanism.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.