T08 · Insecure Dependencies
Warning
- Location
SKILL.md:50- Finding
Execution of an Unpinned Package from a Mutable npm Release Channel
- Content
View full analysis
- Remediation
View remediation
Security audit
企业尽调报告 Pro-标准版(AI付) - 聚合数据
Security checks for vulnerabilities and agentic risk
Overview
The skill appears purpose-aligned, but it needs Review because setup uses a mutable payment-package installer and the API example could be unsafe if implemented through a shell.
Review this before installing in an agent that can run local commands or manage payments. Prefer a pinned, reviewed Alipay installer version, require explicit user approval before enabling payment capabilities, and implement the Juhe request through a structured HTTP client rather than interpolating user input into curl.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:230- Finding
Potential Shell Command Injection Through User-Controlled Keyword Interpolation
- Content
View full analysis
"}}' \ -H "Content-Type: application/json" ``` ``` ### Technical Analysis The prescribed command places a user-controlled company keyword inside a shell command enclosed by single quotes. If an Agent implements this instruction through direct textual substitution and invokes a command shell, an apostrophe in the keyword can terminate the quoted JSON argument. Subsequent shell metacharacters could then be interpreted as command syntax rather than request data. JSON escaping and shell escaping are separate operations. Serializing a value as valid JSON does not make the resulting text safe for interpolation into a shell command. The document instructs the Agent to filter injection characters, but this is an underspecified blacklist-style control and does not guarantee safe shell construction. It also risks inconsistent implementation across Agents. The pre-validation rules reduce exposure by requiring a plausible company name or registration identifier. They do not provide a formal character allowlist that conclusively excludes every shell-significant character, nor do they eliminate the unsafe command-construction primitive. ### Attack Path 1. An attacker submits a crafted company keyword containing a quote boundary and shell syntax while preserving enough company-name structure to pass an incomplete or inconsistently implemented validation step. 2. The Agent substitutes the raw or inadequately sanitized keyword into the document ...[truncated 1276 chars]- Remediation
View remediation
" } } ``` 4. If an external `curl` process is unavoidable, invoke it through an argument-array API with shell processing disabled. Pass the serialized JSON body as one argument rather than embedding it in a command string. 5. Never use `shell=true`, `eval`, command concatenation, or equivalent shell-expansion mechanisms for this request. 6. Apply strict allowlist validation as defense in depth: - Credit codes and registration numbers should match explicit length and character rules. - Company names should permit only documented name characters and punctuation. - Reject control characters, line breaks, and unexpected shell-oriented punctuation. 7. Treat validation and escaping as separate controls: validate the business format, serialize as JSON, and avoid the shell entirely. 8. Add regression tests using quotes, line breaks, command separators, command substitutions, and malformed Unicode to confirm that all input remains request data and cannot alter process execution. ]]>
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (54)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The file explicitly requires that user-facing report text use only Chinese column names and forbids English field names. This is a natural-language locale constraint applied to all user output, but the document does not indicate any user choice, opt-in, or region-specific justification for enforcing Chinese-only output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README presents all operational instructions, warnings, and field explanations only in Chinese. Under the policy rule, forcing a specific language without user opt-in or a documented region-specific justification is a natural-language policy violation.
- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
The document contains unusually large padded table cells and oversized inline content that can inflate token usage and consume model context without adding operational value. In an agent setting, this can degrade instruction following, crowd out higher-priority safety guidance, and increase the chance of incorrect handling of sensitive enterprise data returned by the skill.
- Content
md ### 基本照面 | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
Hundreds of consecutive spaces are present as visual padding, which is a classic prompt-manipulation or prompt-hygiene issue in agent-consumable content. Excessive whitespace wastes context tokens and can help bury important instructions, increasing the chance that the model overlooks privacy and result-limitation requirements.
- Content
md ### 基本照面 | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 25 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 86% confidence
- Finding
The repeated hyphen run in the table separator is abnormally long and serves as another form of token-wasting padding. Combined with adjacent whitespace-heavy rows, it contributes to context-window degradation and can reduce attention to critical privacy and completeness instructions.
- Content
md ### 基本照面 | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
This section continues the same context-expansion pattern with oversized table formatting that unnecessarily increases prompt volume. In an LLM-powered agent, bloated skill text can reduce the effective attention available for payment, privacy, and masking requirements, creating a realistic safety degradation risk.
- Content
md | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
This line contains extreme whitespace padding with no semantic purpose. In LLM-based systems, such padding can degrade performance and reduce attention to safeguards about masking identifiers and not logging plaintext ID numbers.
- Content
md | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 85% confidence
- Finding
The repeated wide table rows appear designed or maintained in a way that consumes context disproportionately to their value. Because this skill handles sensitive public identifiers and payment-gated output, context bloat can interfere with consistent enforcement of redaction and logging restrictions.
- Content
md | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
The repeated spaces indicate documentation crafted or maintained without regard to prompt safety. That matters here because the skill explicitly returns sensitive public identifiers and requires differentiated handling of enterprise codes versus ID-card numbers.
- Content
md | 字段 | 样例值 | | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
The finding reflects persistent context stuffing via oversized markdown formatting. While not code execution, it is dangerous in agent environments because it can dilute system/developer instructions and raise the probability of unsafe output rendering or omission of masking requirements.
- Content
md | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 | | econ_kind | 有限责任公司（法人独资） ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
Large whitespace runs continue to pad the prompt while providing no benefit. This can obscure nearby instructions and contribute to model confusion in a workflow where disclosure limits and redaction are important.
- Content
md | --------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 | | econ_kind | 有限责任公司（法人独资） ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
The content remains excessively padded and token-heavy, which can impair model reliability under context constraints. In this skill's context, degraded reliability matters because the README itself warns that some returned identifiers may require masking and must not be logged in cleartext.
- Content
md | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 | | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
This is another excessive-space line that inflates token usage and harms prompt clarity. The skill context makes it more relevant because it may process risk records and identifiers whose safe display depends on the model reliably remembering policy details.
- Content
md | name | 北京天谱同盛教育科技有限公司 | | status | 吊销 | | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
Oversized formatting continues to add token overhead without functional benefit. This can cause an agent to miss constraints such as 'only recent page is queried' or 'ID numbers must be masked,' leading to misleading or privacy-impacting output.
- Content
md | status | 吊销 | | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 | | regist_capi | 1000万人民币 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
Whitespace padding of this magnitude is unnecessary and can act as a context-burying mechanism. In a paid due-diligence skill, that can indirectly lead to user harm through omitted warnings or improper handling of sensitive fields.
- Content
md | status | 吊销 | | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 | | regist_capi | 1000万人民币 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
This is another instance of context stuffing through inflated markdown structure. In isolation it may seem harmless, but across many lines it materially increases prompt load and therefore the chance of instruction loss in an agent processing regulated or sensitive business data.
- Content
md | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 | | regist_capi | 1000万人民币 | | regist_capi_new | 1000 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
The line shows repeated whitespace padding consistent with prompt bloat. In agent settings, prompt bloat reduces the reliability of higher-priority instructions such as redaction, data minimization, and partial-results caveats.
- Content
md | econ_kind | 有限责任公司（法人独资） | | oper_name | 李谦 | | regist_capi | 1000万人民币 | | regist_capi_new | 1000 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
The table padding and repeated large cells unnecessarily consume context window budget. For a paid data-retrieval skill, this raises operational risk by making it more likely that critical caveats about partial results and data minimization are ignored or truncated.
- Content
md | oper_name | 李谦 | | regist_capi | 1000万人民币 | | regist_capi_new | 1000 | | currency_unit | CNY ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
Excessive spaces consume context while adding no meaning. Because the skill contains many nuanced handling requirements, any avoidable loss of context efficiency creates an indirect but meaningful security and privacy risk.
- Content
md | oper_name | 李谦 | | regist_capi | 1000万人民币 | | regist_capi_new | 1000 | | currency_unit | CNY ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
This finding is part of a sustained pattern of documentation bloat that can crowd out more important safety instructions. The danger is amplified here because the skill includes legal-risk summaries and potentially sensitive identifiers, where agent mistakes can mislead users or expose data improperly.
- Content
md | regist_capi | 1000万人民币 | | regist_capi_new | 1000 | | currency_unit | CNY | | start_date | 2014-07-30 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
This is part of a long run of whitespace-padded lines that can bury important instructions. The danger is elevated by the presence of sensitive fields and disclosure limitations that the model must retain exactly.
- Content
md | regist_capi | 1000万人民币 | | regist_capi_new | 1000 | | currency_unit | CNY | | start_date | 2014-07-30 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
Large padded content continues to increase prompt complexity and decrease robustness. In an adversarial or constrained context, unnecessary bulk can be used to hide or overshadow important restrictions about display minimization and prohibition on plaintext logging.
- Content
md | regist_capi_new | 1000 | | currency_unit | CNY | | start_date | 2014-07-30 | | check_date | 2021-05-21 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
The padding again adds token cost and reduces prompt quality. In context, this increases the chance of privacy failures or misleading report summaries if critical caveats are not attended to properly.
- Content
md | regist_capi_new | 1000 | | currency_unit | CNY | | start_date | 2014-07-30 | | check_date | 2021-05-21 ...[truncated 26 chars]
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 84% confidence
- Finding
The issue remains the same: excessive token consumption through bloated formatting. That becomes security-relevant because the skill explicitly handles identifiers that may include ID-card numbers requiring masking, and context loss can produce unsafe handling.
- Content
md | currency_unit | CNY | | start_date | 2014-07-30 | | check_date | 2021-05-21 | | term_start | 2014-07-30 ...[truncated 26 chars]
Whitespace Padding
Medium
- Category
- Prompt Injection
- Confidence
- 88% confidence
- Finding
Repeated non-semantic whitespace is an agent-safety smell because it wastes context budget. Given that the document includes explicit bans on plaintext ID logging, wasting context makes adherence less reliable.
- Content
md | currency_unit | CNY | | start_date | 2014-07-30 | | check_date | 2021-05-21 | | term_start | 2014-07-30 ...[truncated 26 chars]
Static analysis
No suspicious patterns detected.