ClawHub
Back to skill

Security audit

企业限制高消费信息查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent Juhe API lookup tool, but users should protect the API key and understand that query details are sent to Juhe.

Install only if you are comfortable sending enterprise/applicant/case lookup terms to Juhe for processing and billing. Prefer the JUHE_ENTERPRISE_RESTRICTION_KEY environment variable or a managed secret; avoid passing the key with --key, and if using scripts/.env, keep it out of version control and restrict access.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/enterprise_restriction.py:243
Finding

API Key Exposure Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: scripts/enterprise_restriction.py:243-245 and SKILL.md:35-40
Vulnerability Type: Credential exposure through process arguments and shell history
Risk Level: Medium

The Skill supports passing the Juhe API key directly through the --key command-line option and explicitly documents this method.

Vulnerable implementation:

python
if args[i] == "--key" and i + 1 < len(args):
    cli_key = args[i + 1]
    i += 2

Documented usage:

bash
# Option 3: Pass it on the command line for each invocation
python scripts/enterprise_restriction.py --key YOUR_APP_KEY --name COMPANY_NAME

Technical Analysis

Command-line arguments are not an appropriate transport mechanism for secrets. Depending on the operating system and execution environment, arguments may be exposed through process-listing utilities, process metadata, audit frameworks, monitoring agents, job-runner logs, terminal scrollback, and shell history.

The API key is subsequently sent to the fixed Juhe HTTPS endpoint as required for the declared lookup functionality. That network transfer is expected and necessary. The vulnerability is the optional local credential-input method, not the use of the declared remote API.

The script also supports an environment variable and a local .env file, so accepting the key through --key is not required for the Skill's core functionality and exceeds the minimum safe credential-handling design.

Attack Path

  1. A user follows the documented example and invokes the script with --key.
  2. The complete command, including the API key, may be stored in shell history or captured by process monitoring, audit logging, or orchestration telemetry.
  3. A local user or component with access to that data extracts the API key.
  4. The exposed key is reused against the Juhe API.
  5. The attacker consumes paid quota or accesses the API entitlement associated with t ...[truncated 766 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the --key command-line option and all documentation examples that place credentials in command arguments.
  2. Retain the dedicated JUHE_ENTERPRISE_RESTRICTION_KEY environment variable as the primary supported configuration method.
  3. If .env support remains, require owner-only permissions such as mode 0600, reject files with unsafe permissions where practical, and ensure .env is excluded from version control.
  4. For interactive use, optionally read the key with Python's getpass.getpass() so it is not echoed or stored in command history.
  5. Avoid including credentials in exceptions, debug output, query-result objects, or telemetry.
  6. Rotate any API key previously supplied through the documented --key method if command histories or execution logs may have been retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Credential Access

High
Category
Privilege Escalation
Confidence
88% confidence
Finding

The skill instructs users to write the API key into scripts/.env, which creates a plaintext secret file in the project workspace. In agent or shared development environments, such files are commonly readable by other tools, accidentally committed to version control, or exposed through file-access capabilities.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
export JUHE_ENTERPRISE_RESTRICTION_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_ENTERPRISE_RESTRICTION_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/enterprise_restriction.py --key 你的 AppKey --name 山西尧信融资再担保有限公司

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_restriction.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/836
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_restriction.py (reported line 14)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_restriction.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/836
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_restriction.py (reported line 347)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python enterprise_restriction.py --key your_api_key --name 企业名称
    2. 环境变量：export JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_ENTERPRISE_RESTRICTION_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/836
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/enterprise_restriction.py (reported line 70)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill documents use of environment variables, local files, and outbound network access, but it does not declare any explicit tool scope or permissions boundary. That omission increases the chance of overbroad execution in agent environments, where a caller may not realize the skill can read secrets and send data to a third party.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The trigger phrases include broad colloquial language like '不能坐飞机高铁' and '查一下限高记录', which could match loosely related conversations and cause unintended invocation. In this skill, unintended invocation is privacy-relevant because the resulting action may transmit company or applicant identifiers to a paid third-party API.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The AI usage guidance tells the agent to collect company names, credit codes, registration numbers, applicants, and case details, but it does not clearly warn that these user-provided values will be sent to juhe.cn. This creates a meaningful transparency and privacy issue because potentially sensitive legal/commercial query terms are disclosed to an external service without explicit user awareness.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The function sends user-supplied enterprise names, applicant names, case numbers, and other query attributes to a third-party API endpoint, but the script does not prominently warn users that their input will leave the local environment. In a skill context, these queries may contain sensitive business or personal investigation data, so silent transmission creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The manifest describes a skill for querying enterprise restriction records by enterprise name, unified social credit code, registration number, or applicant, and returning core case fields. The code additionally supports historical-name expansion, case-number filtering, fuzzy case-number matching, date-range filtering, province/city filtering, serial number lookup, and optional retrieval of the restriction-order full text, which goes beyond the described user-facing scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

The code accesses a sensitive credential via the JUHE_ENTERPRISE_RESTRICTION_KEY environment variable and a local .env file. While this is a common pattern, the file does not include any warning or guidance about protecting the key, avoiding accidental disclosure, or securing the .env file.

Content

No source excerpt is available for this finding.