ClawHub
Back to skill

Security audit

Summary of JisuAPI - 极速数据API汇总

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent JisuAPI gateway, but it can send sensitive identifiers and OCR image data to a third-party API without a clear consent or privacy warning.

Review before installing. This skill is not showing deception or destructive behavior, but it can transmit user-provided phone numbers, ID card numbers, bank card numbers, IPs, addresses, VINs, QR/barcode content, and OCR images to JisuAPI. Only use it if that third-party data sharing is acceptable, and avoid sending sensitive documents or financial identifiers unless you have a clear reason and user consent.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (10)

Tp2

High
Category
MCP Tool Poisoning
Confidence
85% confidence
Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill declares access to an environment variable and clearly relies on outbound network access, but it does not explicitly declare a tool scope such as permissions or allowed-tools. This weakens least-privilege controls and makes it easier for an agent platform to invoke the skill without clear operator visibility into data access and external transmission behavior.

Vague Triggers

Medium
Confidence
94% confidence
Finding
The trigger guidance is very broad ('same interface for weather/gold/one-stop gateway' and similar phrasing), which can cause over-invocation of a skill that sends arbitrary user-supplied parameters to a third-party API. Overly loose routing increases the chance that unrelated or sensitive user requests are forwarded externally without sufficient user awareness or intent confirmation.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill encourages users to submit data like ID numbers, phone numbers, bank card numbers, VINs, addresses, and images for OCR, but it does not clearly warn that this information will be sent to a third-party provider. This creates a meaningful privacy and compliance risk because sensitive personal or financial data may be disclosed off-platform without informed consent.

Context-Inappropriate Capability

Medium
Confidence
92% confidence
Finding
The skill exposes endpoints for querying personal or regulated data such as phone number attribution, ID card lookup, bank card lookup, IP geolocation, and enterprise contact data. While the code restricts calls to an allowlist, the manifest describes a general data gateway and does not warn that sensitive personal-data lookups are supported, increasing the risk of privacy-invasive or unexpected use.

Context-Inappropriate Capability

Medium
Confidence
89% confidence
Finding
The skill includes OCR and image-recognition endpoints for VIN, ID cards, bank cards, QR/barcode decoding, and general text recognition that are not reflected in the summary description. These endpoints can process highly sensitive images and identifiers, so their presence materially expands the data-handling risk beyond what a user would reasonably expect from a generic aggregated data-query skill.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
User-supplied parameters are forwarded directly to a third-party service, including potentially sensitive fields such as ID numbers, bank card numbers, phone numbers, IP addresses, VINs, addresses, and OCR image payloads. Although the destination host and API path are constrained, there is no explicit consent flow, minimization, or warning before external transmission, creating meaningful privacy and data-protection risk.

External Transmission

Medium
Category
Data Exfiltration
Content
def _call_jisu_api(api_path: str, appkey: str, params: dict = None) -> Any:
    """
    统一调用：https://api.jisuapi.com/{api_path}
    - 大部分接口使用 GET；
    - 部分识别类接口（vinrecognition/generalrecognition/idcardrecognition/bankcardcognition）
      官方文档推荐使用 POST，这里自动切换为 POST，并将参数放在表单中。
Confidence
91% confidence
Finding
The skill is explicitly designed to send data to an external API endpoint, and that behavior is real rather than a false positive. In this context the transmission is expected, but it becomes security-relevant because the same generic call path can carry sensitive identifiers and OCR data to the external provider without additional controls.

Natural-Language Policy Violations

Low
Confidence
78% confidence
Finding
文件标题与描述全部以中文呈现，且未说明该技能是否仅面向中文用户或中国区场景，也未给出语言选择机制。若组织要求避免在未征得用户同意时强制特定语言/区域，这种默认中文化描述可能构成语言/locale 策略问题。

Natural-Language Policy Violations

Low
Confidence
85% confidence
Finding
The module description and command usage/help strings are presented only in Chinese, which can impose a fixed language on users without opt-in or alternative locale support. This matches the policy category for language or locale constraints not accompanied by user choice or clear justification.

Static analysis

No suspicious patterns detected.