ClawHub
Back to skill

Security audit

企业信息精确查询(AI付) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This paid enterprise lookup skill is mostly coherent, but it asks users to install a mutable Alipay payment package at runtime for a wallet/payment workflow.

Review the payment dependency before installing. Prefer a pinned, verified version of the Alipay payment package and avoid running a mutable `@latest` install in an environment with unrelated credentials or sensitive files. Also confirm you are comfortable sending the queried company name or registration code to Juhe and receiving payment details through the Alipay payment skill.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:39
Finding

Unpinned npm Package Execution Through npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 39
Vulnerability Type: Supply-chain risk from mutable dependency retrieval and execution
Risk Level: Medium

Vulnerable Code

text
- **If not installed**, prompt: use npx -y @alipay/agent-payment@latest install to **install and enable the Alipay AI wallet capability**, then help me **enable Alipay payment functionality**

The operative command in the original instruction is:

shell
npx -y @alipay/agent-payment@latest install

Technical Analysis

The Skill instructs the Agent to use npx to retrieve and execute an npm package. The @latest tag is mutable, so the package version and effective executable payload can change after this Skill has been reviewed. The -y option automatically accepts the installation prompt, reducing the opportunity for the user or operator to inspect the resolved version before execution.

The project does not include a lockfile, exact dependency version, package integrity hash, signature-verification procedure, or vendored audited implementation. Consequently, the reviewed Skill cannot establish which package code will execute when this instruction is followed.

This is an insecure dependency practice rather than evidence that the current package is malicious. Exploitation would require compromise of the package, its publisher account, the npm distribution path, or publication of an unsafe future release under the mutable tag.

Attack Path

  1. A user invokes the company-information Skill.
  2. The Skill determines or claims that the required Alipay payment capability is not installed.
  3. The Agent presents or executes npx -y @alipay/agent-payment@latest install.
  4. npm resolves @latest at execution time and downloads the corresponding package and dependencies.
  5. npx executes package-controlled code without an interactive package-installation confirmation.
  6. If the resolved package or one of ...[truncated 819 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version; do not use a version range or mutable distribution tag.
  2. Verify package provenance, publisher identity, signatures or attestations, and the complete transitive dependency tree before recommending execution.
  3. Record and verify an integrity digest for the approved package artifact. Prefer a controlled dependency workflow with a lockfile and immutable registry configuration.
  4. Remove -y so the resolved package name and exact version are shown before execution.
  5. Require explicit informed user approval before downloading or executing the dependency.
  6. Run installation with least privilege in an isolated environment that cannot access unrelated credentials, files, wallet state, or sensitive environment variables.
  7. Prefer a preinstalled, administrator-reviewed payment integration over runtime package retrieval.
  8. Define failure behavior that stops the paid workflow when the exact approved dependency cannot be verified, rather than falling back to the newest available release.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (6)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The title and the entire output specification require responses in Chinese, and there is no indication that users may opt into another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the restriction is clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The README is entirely written as a Chinese-only user-facing skill description and does not indicate that users may choose another language or locale. Under the policy, language constraints should be opt-in or explicitly justified as region-specific; neither is stated here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The entire skill description, trigger phrases, confirmation examples, and required user replies are specified only in Chinese, including prescribed affirmative replies like “确认”“好的”“可以”. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only regulatory or regional context.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs users to install a package with npx -y @alipay/agent-payment@latest, which pulls an unpinned, mutable package version at execution time. If the upstream package is compromised or a breaking/malicious release is published, users may install and run unintended code with little review.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

向用户展示待查询的参数，严格遵守请求约束，向以下 URL 发起请求：

text
curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"319","data":{"keyword":"天聚地合"}}' \
  -H "Content-Type: application/json"

Ssd 3

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The instruction to pass the entire 402 payment response to another skill risks over-sharing payment and order metadata beyond the minimum necessary fields. Even if the downstream payment skill is trusted, full-response forwarding increases exposure of transaction identifiers or other sensitive fields and broadens the attack surface if logs, prompts, or intermediate handling are imperfect.

Content

No source excerpt is available for this finding.