ClawHub
Back to skill

Security audit

企业被执行人信息查询（公示中及历史） - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Juhe API lookup tool for Chinese enterprise enforcement records, with expected network and API-key use but some credential-handling cautions.

Install only if you intend to query Juhe for Chinese enterprise enforcement records and are comfortable sending lookup terms and your Juhe API key to that provider. Prefer the documented environment variable for the key; avoid putting the key in command-line arguments, shell history, or an unprotected .env file, and confirm ambiguous lookup requests before running the script.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enterprise_executed.py:271
Finding

API Credential Exposure Through Command-Line Arguments and Insecure Plaintext Storage

Content
View full analysis

Vulnerability Details

File Location: scripts/enterprise_executed.py:69-83, 271-273, 329, 356-358; SKILL.md:27-33
Vulnerability Type: API credential disclosure
Risk Level: Medium

The skill supports passing the Juhe API key directly as a command-line argument and recommends this method in its documentation. Command-line arguments may be exposed through shell history, process inspection, execution telemetry, and command logging.

The skill also supports loading the credential from a plaintext .env file but neither creates that file with restrictive permissions nor verifies its ownership or permissions before reading it.

Relevant credential-loading code:

python
def load_api_key(cli_key: str = None) -> str:
    if cli_key:
        return cli_key

    env_key = os.environ.get("JUHE_ENTERPRISE_EXECUTED_KEY", "").strip()
    if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()
            if line.startswith("JUHE_ENTERPRISE_EXECUTED_KEY="):
                val = line.split("=", 1)[1].strip().strip('"').strip("'")
                if val:
                    return val
    return ""

Relevant command-line parsing code:

python
if args[i] == "--key" and i + 1 < len(args):
    cli_key = args[i + 1]
    i += 2

The script explicitly advertises the unsafe command-line option:

python
print("  --key KEY              API Key（可选，可用环境变量配置）")
python
print("   1. 环境变量：export JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key")
print("   2. .env 文件：在脚本目录创建 .env，写入 JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key")
print("   3. 命令行参数：python enterprise_executed.py --key your_api_key --name 企业名称")

The Skill documentation similarly recommends both plaintext storage and command-line entry: ...[truncated 2456 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove support for supplying the API key through --key, and remove all command-line examples that embed credentials.
  2. Prefer a dedicated secret manager or a narrowly scoped environment variable injected by the execution platform.
  3. If interactive credential entry is required, use getpass.getpass() so the key is not echoed or placed in process arguments.
  4. If .env support remains necessary:
    • Document creation with restrictive permissions, such as install -m 600 /dev/null scripts/.env.
    • Require permission mode 0600 or stricter before loading the file.
    • Verify that the file is owned by the effective user.
    • Reject symbolic links and unexpected non-regular files.
    • Add scripts/.env and equivalent secret files to .gitignore.
    • Warn users never to commit, archive, or share the file.
  5. Rotate any key previously supplied on a command line or stored in a file with uncertain permissions.
  6. Use a least-privileged API credential with appropriate quota and service restrictions, where the provider supports them.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_executed.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/842
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_executed.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/842
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_executed.py (reported line 14)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_executed.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/842
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_executed.py (reported line 357)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_executed.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_EXECUTED_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/842
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_executed.py (reported line 75)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill documents and requires capabilities to read environment variables, read local files (for .env), and make network requests, but it does not declare any explicit tool scope or allowed-tools boundary. That creates an authorization gap where a host agent may permit broader access than users expect, increasing the chance of unintended secret access or outbound data transmission.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The trigger phrases are broad enough to activate on common discussion of enforcement, court action, or execution-related topics, which can cause the skill to run in contexts where the user did not intend a third-party enterprise lookup. Because the skill performs live external queries, overbroad triggering can lead to unnecessary data disclosure and surprise API calls.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill sends potentially sensitive corporate identifiers and may receive personally identifying fields such as partyCardNum, yet the markdown lacks a clear user-facing privacy warning that the query is transmitted to juhe.cn. In a compliance-sensitive context involving legal and identity-related data, silent third-party sharing raises privacy, consent, and regulatory risks.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The script's docstring, help text, and runtime messages are entirely in Chinese, which effectively imposes a specific language on users. Under the stated policy, locale or language restrictions should either be optional for the user or clearly justified as region-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The script sends user-supplied enterprise identifiers and the API key to a third-party remote service over the network, but the interface and help text do not clearly warn users that their query terms and credentials will be disclosed externally. In this skill context, queried company names, registration numbers, and case filters may be sensitive business investigation data, so silent transmission creates a real privacy and data-handling risk even though HTTPS is used.

Content

No source excerpt is available for this finding.