企业工商信息列表查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 8, 2026 · 8:09 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it needs Review because it encourages handling a paid API key through command-line arguments or a plaintext file.

Install only if you are comfortable sending enterprise search terms to Juhe and using your own Juhe business API entitlement. Prefer a protected environment variable or secret manager for JUHE_ENTERPRISE_LIST_KEY, avoid passing the key with --key, and do not store scripts/.env in a shared or version-controlled directory.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enterprise_list.py:38
• Finding: API Credentials May Be Exposed Through Command-Line Arguments and Plaintext Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/enterprise_list.py:38-51, 163-164` **Additional Documentation Location**: `SKILL.md:36-39` **Vulnerability Type**: Insecure credential handling **Risk Level**: Medium ### Vulnerable Code ```python def load_api_key(cli_key: str = None) -> str: """Load the API key according to the configured priority.""" if cli_key: return cli_key env_key = os.environ.get("JUHE_ENTERPRISE_LIST_KEY", "").strip() if env_key: return env_key env_file = Path(__file__).parent / ".env" if env_file.exists(): for line in env_file.read_text(encoding="utf-8").splitlines(): line = line.strip() if line.startswith("JUHE_ENTERPRISE_LIST_KEY="): val = line.split("=", 1)[1].strip().strip('"').strip("'") if val: return val return "" ``` ```python if args[i] == "--key" and i + 1 < len(args): cli_key = args[i + 1] i += 2 ``` The documentation explicitly supports both command-line and plaintext-file credential configuration: ```bash echo "JUHE_ENTERPRISE_LIST_KEY=<AppKey>" > scripts/.env python scripts/enterprise_list.py --key <AppKey> --keyword <enterprise-name> ``` ### Technical Analysis The script accepts the Juhe API key directly through the `--key` command-line argument. Command-line arguments can be observable through process-inspection facilities, monitoring agents, debugging tools, job metadata, shell history, and automation logs. Any local user or service with sufficient process visibility may capture the credential while the command is running or retrieve it from retained execution records. The script also reads the API key from an unencrypted `scripts/.env` file without checking file ownership or permissions. If that file is group-readable, world-readable, included in an archive, or accidentally committed to source control, the credential may be disclosed. The credential is legiti ...[truncated 1789 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove support for supplying API keys through `--key`, or clearly deprecate it and reject command-line credential values in normal operation. 2. Prefer a protected environment variable populated by the runtime's secret-management facility rather than by an interactive shell command that may be recorded. 3. For CI or agent deployments, retrieve the key from a dedicated secret manager and inject it only into the process environment at execution time. 4. If `.env` support must remain: - Require restrictive permissions such as mode `0600`. - Verify that the file is owned by the current user. - Reject files writable or readable by unauthorized users. - Add `scripts/.env` and other secret-bearing files to `.gitignore`. - Document that the file must never be committed, archived, or shared. 5. Update all examples to use placeholders and avoid encouraging commands that place real credentials in shell history. 6. Provide key-rotation guidance for users who may already have supplied credentials through command-line arguments or committed a `.env` file. 7. Ensure error messages, logs, telemetry, and exception reporting never include the API key or the encoded request body. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The trigger phrases are broad business-language terms like '查企业' and '查公司', which can cause the skill to activate in ambiguous contexts. That increases the chance of collecting and transmitting company names or identifiers to a third-party API without sufficiently specific user intent.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The description says the skill queries enterprise information via juhe.cn, but it does not clearly warn that user-supplied company names, registration numbers, or unified social credit codes are transmitted to a third-party service. Because these identifiers may be sensitive business data, lack of explicit disclosure creates a privacy and data-handling risk.

Credential Access

High

• Category: Privilege Escalation

Content

export JUHE_ENTERPRISE_LIST_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_LIST_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_list.py --key 你的 AppKey --keyword 天聚地合

• Confidence: 72% confidence
• Finding: The explicit recommendation to write the API key into scripts/.env can lead to credential exposure if that directory is committed, shared, or readable by other local users. While not malicious, normalizing plaintext secret storage in a project path increases the risk of accidental disclosure.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/enterprise_list.py:15