ClawHub
Back to skill

Security audit

银行卡类型及归属地查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it claims, but it sends full bank card numbers and the API key over plaintext HTTP, which is unsafe for financial data.

Review carefully before installing. Do not use this with real card numbers or production Juhe keys unless the implementation is changed to HTTPS, avoids putting secrets in URLs or command-line arguments, and clearly tells users that card numbers are sent to Juhe. Rotate any API key already used with the current HTTP implementation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/bankcard_lookup.py:26
Finding

Full Bank Card Numbers and API Credentials Transmitted over Plaintext HTTP

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/bankcard_lookup.py:200
Finding

API Key Exposure through Command-Line Arguments and Weakly Protected Local Configuration

Content
View full analysis
scripts/.env python scripts/bankcard_lookup.py --key YOUR_API_KEY 6228480402564890018 ``` ### Technical Analysis Command-line arguments are not an appropriate channel for secrets. Depending on the operating system and process-isolation configuration, command arguments may be observable through process inspection interfaces while the command is running. They are also commonly retained in shell history, terminal logs, automation logs, and job metadata. The documented `.env` creation command does not establish restrictive permissions. The resulting file permissions depend on the user's umask and may permit other local users to read the API key. The Skill also does not verify or correct the file's permissions before reading it. The API key is legitimately required for the declared external lookup service, but exposing it through command arguments or a potentially permissive plaintext file is not necessary. ### Attack Path #### Command-line exposure 1. A user follows the documentation and supplies the API key through `--key`. 2. The shell may store the complete command in its history. 3. While the process runs, a local user or monitoring process inspects its command-line arguments; alternatively, an attacker later reads exposed shell or automation logs. 4. The attacker extracts the Juhe API key. 5. The attacker sub ...[truncated 975 chars]
Remediation
View remediation
scripts/.env chmod 600 scripts/.env ``` 4. Before reading `.env`, inspect its ownership and mode. Refuse to load it, or emit a clear security error, if it is group-readable or world-readable. 5. Ensure `.env` is excluded from source control and packaging through appropriate ignore and build rules. 6. Avoid printing, logging, or including the credential in exception messages. 7. Use a minimally privileged, revocable API key and establish a rotation procedure. 8. Update all usage messages and documentation to remove command-line secret examples. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs sending full bank card numbers to a third-party API but does not provide a user-facing privacy warning or consent step. Bank card numbers are highly sensitive financial data, and transmitting them to an external service without explicit disclosure can create privacy, compliance, and data-handling risks if the provider logs, retains, or misuses the data.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The documentation recommends placing the API key into scripts/.env, which can lead to credential leakage if the file is committed, packaged, or made readable by other local users. Because the skill also handles sensitive financial queries, compromise of the API key could enable unauthorized API use, billing abuse, and uncontrolled third-party requests under the owner's account.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export JUHE_BANKCARDCODE_KEY=你的AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_BANKCARDCODE_KEY=你的AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/bankcard_lookup.py --key 你的AppKey 6228480402564890018

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARDCODE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARDCODE_KEY=your_api_key
    3. 直接传参: python bankcard_lookup.py --key your_api_key <卡号>

免费申请 API Key: https://www.juhe.cn/docs/api/id/305

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bankcard_lookup.py (reported line 13)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARDCODE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARDCODE_KEY=your_api_key
    3. 直接传参: python bankcard_lookup.py --key your_api_key <卡号>

免费申请 API Key: https://www.juhe.cn/docs/api/id/305

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bankcard_lookup.py (reported line 219)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARDCODE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARDCODE_KEY=your_api_key
    3. 直接传参: python bankcard_lookup.py --key your_api_key <卡号>

免费申请 API Key: https://www.juhe.cn/docs/api/id/305

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script sends both the bank card number and API key in a URL query string to an explicit HTTP endpoint, so the request is unencrypted in transit. Query parameters are also commonly exposed in proxies, logs, browser/history equivalents, monitoring systems, and upstream infrastructure, making leakage of highly sensitive financial identifiers and credentials much more likely.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/bankcard_lookup.py (reported line 39)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises code-capable behavior involving environment variables, file access, and outbound network requests, but it does not declare any explicit tool scope or permission boundaries. This increases the chance that an agent runtime will invoke the skill with broader capabilities than users or platform policy expect, reducing transparency and weakening least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

L003 的使用场景列出“查一下这个银行卡号”“这个卡是哪个银行的”“查银行卡信息”等自然语言短语，但没有限定这些短语仅在明确提供银行卡号或特定上下文时才触发。其中“这个卡是哪个银行的”这类表述在日常对话中较常见，且文档未给出不应触发的反例或边界条件。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Natural-language strings throughout the script, including the module docstring, usage instructions, and runtime messages, are fixed to Chinese. This enforces a specific language without offering the user any locale selection or documenting a justified region-specific constraint.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.