企业工商信息详情查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 8, 2026 · 7:44 AM UTC
• Version: 1.0.0

Overview

This skill performs the company lookup it advertises, but users should handle the Juhe API key carefully and expect company identifiers to be sent to Juhe.

Install only if you are comfortable sending company names, registration numbers, or unified social credit codes to Juhe. Prefer the JUHE_ENTERPRISE_DETAIL_KEY environment variable, avoid passing the key on the command line or in URLs, and do not commit any .env file containing the key.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enterprise_detail.py:205
• Finding: API Credential Exposure Through Command-Line Arguments and URL Query Parameters<![CDATA[ ## Vulnerability Details **File Locations**: - `SKILL.md:39-43` - `SKILL.md:87-90` - `scripts/enterprise_detail.py:10-13` - `scripts/enterprise_detail.py:205-216` **Vulnerability Type**: API credential exposure **Risk Level**: Medium ### Vulnerable Code and Documentation The Skill recommends passing the API key directly as a command-line argument: ```bash # Option 3: Pass it on the command line for each invocation python scripts/enterprise_detail.py --key YOUR_APP_KEY --keyword "Company Name" ``` The script also advertises and accepts this insecure configuration method: ```python API Key configuration, in descending priority: 1. Command-line argument: python enterprise_detail.py --key your_api_key --keyword CompanyName ``` ```python if args[i] == "--key" and i + 1 < len(args): cli_key = args[i + 1] i += 2 ``` The documentation additionally recommends a direct GET request that embeds the API credential and enterprise identifier in the URL: ```text GET https://japi.juhe.cn/enterprise/getDetailByName?key=YOUR_KEY&keyword=CompanyName ``` ### Technical Analysis Secrets supplied through command-line arguments can be exposed through: - Shell command history - Process listings and process-inspection interfaces - Job-control and process-monitoring tools - Terminal session recordings - Command logging, telemetry, and diagnostic systems - CI/CD logs or automation output Embedding the API key in a URL creates additional exposure because complete URLs may be retained in reverse-proxy logs, web-server access logs, browser history, monitoring platforms, network diagnostics, and error reports. The `keyword` parameter may contain a registration number or unified social-credit code and can consequently also enter those records. The actual runtime API call in `scripts/enterprise_detail.py` uses HTTPS and sends the key and keyword to the declared Juhe endpoint as form-encoded POST data: ```python params = {"key": api_key, "keyword": keywor ...[truncated 1985 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove support for the `--key` command-line option so credentials cannot be exposed through process arguments or shell history. 2. Remove the documented GET example containing `key=YOUR_KEY`. Do not place credentials in URLs or query strings. 3. Prefer the existing `JUHE_ENTERPRISE_DETAIL_KEY` environment variable for noninteractive execution. 4. For interactive use, accept the key through a non-echoing prompt such as Python's `getpass.getpass()`. 5. If `.env` support is retained: - Require restrictive file permissions, such as `chmod 600 scripts/.env`. - Ensure `.env` is excluded from version control. - Warn users not to place the file in shared or web-accessible directories. 6. Avoid printing, logging, or including the API key in exceptions and diagnostic output. 7. Update all help text, examples, and configuration instructions to remove command-line and URL-based secret handling. 8. Rotate any API key that may previously have been passed through command-line arguments or embedded in logged URLs. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases are broad business-language prompts such as '工商详情', '经营范围', and '股东和法人', which can overlap with ordinary user conversation and cause unintended invocation. In a skill that sends user-supplied company identifiers to a third-party API, ambiguous activation increases the risk of unnecessary data disclosure and user surprise.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill does not warn users that queries are sent to a third-party provider and may return sensitive company-linked information such as legal representative names, addresses, shareholders, personnel, and abnormal-operation records. Without an explicit disclosure, users may unknowingly submit sensitive organizational data to an external service, creating privacy and compliance risk.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script transmits user-supplied enterprise identifiers together with an API key to a third-party service. Although the endpoint uses HTTPS and this is the intended function of the skill, there is no explicit notice, consent, or data-minimization step, so potentially sensitive business identifiers may be disclosed to an external provider without user awareness.

Credential Access

High

• Category: Privilege Escalation

Content

export JUHE_ENTERPRISE_DETAIL_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_DETAIL_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_detail.py --key 你的 AppKey --keyword 天聚地合（苏州）数据股份有限公司

• Confidence: 94% confidence
• Finding: The documentation instructs users to write the API key into `scripts/.env`, which risks accidental exposure through local file reads, backups, misconfigured repository check-ins, or permissive file permissions. In a skill ecosystem where scripts may read local files, placing credentials in the working tree materially increases secret leakage risk.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/enterprise_detail.py:15