ClawHub
Back to skill

Security audit

运营商5G基站位置查询(AI付版) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill’s cell-tower lookup purpose is coherent, but it asks users to install and enable a mutable payment package with broad account/payment implications and sends location-related identifiers to third parties with limited privacy controls.

Review this skill carefully before installing. Only use it if you are comfortable sharing cell-tower identifiers with Juhe and payment/order metadata with the Alipay payment skill. Avoid running the `npx ... @latest` install path unless you can verify the package source and version, and prefer a pinned, reviewed payment dependency.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:22
Finding

Unpinned Third-Party Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 22
Vulnerability Type: Unpinned and unattended third-party dependency execution
Risk Level: Medium

Complete Code Snippet:

text
- **If not installed**, prompt the user to run:
  npx -y @alipay/agent-payment@latest install

The original instruction invokes npx -y @alipay/agent-payment@latest install to install and enable the payment capability.

Technical Analysis

The Skill directs the Agent or user to download and execute the mutable latest release of the third-party @alipay/agent-payment npm package. npx can execute package code and lifecycle scripts, while -y suppresses the normal confirmation prompt. The instruction does not pin a reviewed version, verify a package integrity hash, or require validation of the retrieved artifact.

Consequently, the code executed at installation time can differ from the code reviewed when this Skill was audited. If the package publisher account, npm registry path, or a future release is compromised, attacker-controlled package code could execute with the privileges of the account running the Agent.

Attack Path

  1. An attacker compromises the referenced npm publisher account, package, registry delivery path, or a future latest release.
  2. The attacker publishes a malicious version under the package name referenced by the Skill.
  3. A user invokes this Skill while the required payment dependency is absent.
  4. The Skill recommends or causes execution of npx -y @alipay/agent-payment@latest install.
  5. npx retrieves the attacker-controlled release and executes its package entry point or installation lifecycle scripts without an interactive package confirmation.
  6. The malicious code operates with the filesystem, environment, and network permissions of the invoking Agent process.

Impact Assessment

Successful exploitation could provide arbitrary code execution under the invoking user ...[truncated 466 chars]

Remediation
View remediation

Remediation Suggestions

  • Replace @latest with an exact, reviewed package version.
  • Use a lockfile and verify the package against an approved integrity hash or trusted artifact manifest before execution.
  • Remove -y and require explicit, informed user confirmation before downloading or executing package code.
  • Prefer a separately reviewed installation process rather than dynamically invoking npx during the Skill workflow.
  • Run dependency installation in a sandbox with minimal filesystem, environment-variable, process, and network access.
  • Disable or strictly control npm lifecycle scripts where operationally possible.
  • Maintain an allowlist of approved package names, versions, publishers, and registry endpoints.
  • Re-review and test each dependency upgrade before changing the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill sends MCC/MNC/LAC/CI cell-tower identifiers to a third-party API to derive location, but does not clearly warn the user that these inputs can reveal sensitive geographic information. Even if not precise GPS, the identifiers can still disclose device vicinity, travel patterns, or other location-linked personal data when transmitted to an external provider.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The skill instructs installing and running an external package via npx -y @alipay/agent-payment@latest, which fetches the latest unpublished-at-review version at execution time. This creates a supply-chain risk because a compromised maintainer account, malicious update, or dependency hijack could cause arbitrary code to run in the agent environment.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

The skill explicitly directs transmission of user-supplied cell-tower identifiers to an external domain (apis.juhe.cn) to obtain location data. This is an intended feature, but it is still a real external data-transfer risk because the transmitted parameters are location-related and can expose sensitive user context if sent without informed consent and strict endpoint validation.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

向用户展示待查询的参数，严格遵守请求约束，向以下 URL 发起请求：

text
curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"849","data":{"mcc":"<需要查询的移动国家代码MCC>","mnc":"<需要查询的移动网络代码MNC>","lac":"<需要查询的位置区码LAC/TAC>","ci":"<需要查询的基站号CI/CID或BID>"}}' \
  -H "Content-Type: application/json"

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The workflow requires forwarding the entire 402 payment response, including transaction metadata such as order identifiers, to another skill without explicit user notice or data-minimization controls. Passing the full response between skills can unnecessarily expose payment-related data and increase the blast radius if the downstream skill mishandles or logs it.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
80% confidence
Finding

The natural-language instructions, prompts, and example user-facing text are all specified in Chinese, including mandatory prompts to install and enable payment features. There is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-speaking or region-specific audience for compliance reasons.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.