ClawHub
Back to skill

Security audit

企业工商异常经营信息查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward Juhe API client for checking Chinese enterprise abnormal-operation records, with some credential-handling practices users should treat carefully.

Install only if you are comfortable sending company identifiers and your Juhe AppKey to Juhe for each query. Prefer a protected environment variable or secret manager; avoid passing the AppKey with --key and be cautious with scripts/.env permissions and source control.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enterprise_abnormal.py:281
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/enterprise_abnormal.py:281-283
Additional Location: SKILL.md:33
Vulnerability Type: API credential exposure through process arguments and shell history
Risk Level: Medium

Vulnerable Code

python
if args[i] == "--key" and i + 1 < len(args):
    cli_key = args[i + 1]
    i += 2

The documentation explicitly promotes this credential-passing mechanism:

bash
python scripts/enterprise_abnormal.py --key YOUR_APP_KEY --name ENTERPRISE_NAME

Technical Analysis

The Skill accepts the Juhe API credential directly through the --key command-line argument. Command-line arguments are not an appropriate secret-transport mechanism because they may be exposed through:

  • Shell history files.
  • Process inspection tools while the command is running.
  • Process accounting and endpoint-monitoring systems.
  • Terminal session recordings.
  • CI/CD, orchestration, or automation logs that record invoked commands.
  • Diagnostic output that captures process arguments.

The network transmission itself is consistent with the declared functionality: the key and requested enterprise identifier are sent over HTTPS to the documented Juhe endpoint. The security issue is the optional local credential-ingestion method, not the required API request.

Attack Path

  1. A user follows the documented example and invokes the script with --key.
  2. The API key becomes part of the process command line and may also be stored in shell history or automation logs.
  3. A local user, monitoring service, log reader, or other party with access to those records obtains the key.
  4. The party submits requests directly to the Juhe API using the compromised credential.
  5. The unauthorized requests consume the victim's paid quota and are attributed to the victim's Juhe account.

Exploitation requires access to process metadata, command history, terminal recordings ...[truncated 932 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove support for the --key command-line option and remove all examples that place credentials in command arguments.
  2. Continue supporting the dedicated JUHE_ENTERPRISE_ABNORMAL_KEY environment variable, while ensuring deployment systems inject it through protected secret-management facilities rather than logging it.
  3. For interactive use, accept the key through a hidden prompt such as Python's getpass.getpass() so that it is not echoed or recorded in shell history.
  4. Prefer an operating-system credential store or managed secret service for long-lived installations.
  5. If .env support remains available:
    • Add scripts/.env and equivalent secret files to .gitignore.
    • Validate that the file is not committed to source control.
    • Require restrictive permissions, such as owner read/write only.
    • Warn or refuse to load the file when permissions allow access by other users.
  6. Update SKILL.md to describe only protected credential-delivery mechanisms.
  7. Rotate any API key previously passed through command-line arguments if shell histories, logs, or process-monitoring records may have captured it.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
78% confidence
Finding

Passing the AppKey directly on the command line can expose credentials through shell history, process listings, audit logs, and terminal recordings. In a shared workstation or multi-user environment, this materially increases the risk of API key disclosure and subsequent unauthorized API usage.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
export JUHE_ENTERPRISE_ABNORMAL_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_ABNORMAL_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_abnormal.py --key 你的 AppKey --name 苏州瀚海知识产权代理有限公司

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_abnormal.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/841
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_abnormal.py (reported line 14)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_abnormal.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/841
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_abnormal.py (reported line 335)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_abnormal.py --key your_api_key --name 企业全名
    2. 环境变量：export JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_ABNORMAL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/841
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_abnormal.py (reported line 89)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill advertises use of environment variables, file reads, and outbound API/network access, but does not declare explicit tool scope or allowed tools. This weakens least-privilege controls and can cause the runtime to grant broader capabilities than users or reviewers expect, especially because enterprise identifiers and API keys are involved.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger phrases are broad enough that the skill may activate on general discussion of '异常' or company review contexts without clear user intent to query a third-party service. Over-broad activation can lead to unintended data transmission or API use, particularly when the skill encourages collecting and sending company identifiers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The description says the skill queries Juhe in real time, but it does not clearly warn that submitted company names, registration numbers, or unified social credit codes are sent to a third-party provider. This creates a privacy/transparency issue because users may not realize sensitive business due-diligence inputs leave the local system.

Content

No source excerpt is available for this finding.