手机号码归属地查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:37 AM UTC
• Version: 1.0.0

Overview

The skill does what it claims, but it sends phone numbers and the API key over unencrypted HTTP, which can expose sensitive data.

Review this skill before installing. It appears purpose-built for Juhe phone-number attribution lookup, but you should not use it with real phone numbers or a valuable API key unless the endpoint is changed to verified HTTPS and you accept that queried numbers are sent to Juhe. Prefer an environment variable for the key over command-line arguments or a shared .env file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/mobile_lookup.py:28

Finding

Phone Numbers and API Credentials Transmitted over Plaintext HTTP

Content

View full analysis

Vulnerability Details

File Location: scripts/mobile_lookup.py:28, 72-81
Vulnerability Type: Plaintext transmission of sensitive information
Risk Level: High

The Skill sends the queried phone number and Juhe API key to an external service through an unencrypted HTTP connection. Although contacting the declared provider is necessary for the Skill's functionality, transmitting these values without TLS is not necessary and violates least-risk data handling.

The vulnerable implementation is:

python

API_URL = "http://apis.juhe.cn/mobile/get"

python

def query_mobile(phone: str, api_key: str) -> dict:
    """Call the Juhe Data API to query mobile-number attribution."""
    params = {
        "phone": phone,
        "key": api_key,
        "dtype": "json",
    }
    url = f"{API_URL}?{urllib.parse.urlencode(params)}"

    try:
        with urllib.request.urlopen(url, timeout=15) as resp:
            data = json.loads(resp.read().decode("utf-8"))

The same insecure transport is explicitly documented in SKILL.md:95:

text

GET http://apis.juhe.cn/mobile/get?phone=13812345678&key=YOUR_KEY

Technical Analysis

HTTP provides no transport confidentiality, integrity, or authenticated endpoint protection. The generated URL places two sensitive values in its query string:

• The user's full 7- or 11-digit mobile number or prefix.
• The Juhe API credential.

Any party capable of observing or intercepting the connection—such as a network gateway, transparent proxy, compromised router, malicious Wi-Fi operator, or on-path attacker—can read both values. An active attacker can also modify the server response because the client has no TLS-based assurance that the response originated from the intended provider.

Query-string placement creates an additional exposure surface because complete URLs are commonly retained by HTTP proxies, monitoring systems, debugging tools, and a ...[truncated 1417 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace the endpoint with the provider's verified HTTPS endpoint:

   python

   API_URL = "https://apis.juhe.cn/mobile/get"
   

2. Update SKILL.md:95 and all examples so they use HTTPS exclusively.

3. Reject non-HTTPS endpoint configurations and unexpected redirects rather than silently downgrading to HTTP.

4. If supported by the provider, send the credential in an authorization header instead of the query string. Otherwise, ensure that application and intermediary logging never records complete request URLs.

5. Prefer loading the key from the environment or a permission-restricted secret file. Discourage --key, because command-line arguments may be exposed through shell history and process inspection.

6. Rotate any API key that may previously have been used with the plaintext endpoint.

7. Add an automated test asserting that the configured API URL uses the https scheme.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (10)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md

API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_MOBILE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_MOBILE_KEY=your_api_key
    3. 直接传参: python mobile_lookup.py --key your_api_key 13812345678

免费申请 API Key: https://www.juhe.cn/docs/api/id/11

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_MOBILE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_MOBILE_KEY=your_api_key
    3. 直接传参: python mobile_lookup.py --key your_api_key 13812345678

免费申请 API Key: https://www.juhe.cn/docs/api/id/11

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mobile_lookup.py (reported line 15)May include surrounding context.

python

API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_MOBILE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_MOBILE_KEY=your_api_key
    3. 直接传参: python mobile_lookup.py --key your_api_key 13812345678

免费申请 API Key: https://www.juhe.cn/docs/api/id/11

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mobile_lookup.py (reported line 248)May include surrounding context.

python

API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_MOBILE_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_MOBILE_KEY=your_api_key
    3. 直接传参: python mobile_lookup.py --key your_api_key 13812345678

免费申请 API Key: https://www.juhe.cn/docs/api/id/11

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/mobile_lookup.py (reported line 41)May include surrounding context.

python

if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation and metadata indicate capabilities involving environment variables, local file access, and outbound network use, but it does not declare any explicit tool scope or permission boundaries. This can cause the agent runtime or reviewers to underestimate what the skill can access, increasing the risk of unintended data exposure or over-privileged execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-supplied phone numbers to a third-party API service, but the description does not clearly warn users that this personal data leaves the local system. Phone numbers are personal data, and undisclosed transmission to an external provider creates privacy, consent, and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script sends phone numbers and the API key to a third-party endpoint over plain HTTP, which allows network attackers to intercept or modify the request and response. Because the data includes personal phone numbers and credentials, this creates both privacy exposure and credential leakage risks, and the lack of an explicit warning makes misuse more likely in an agent/skill context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation advertises a '--no-mask' option that reveals full phone numbers, but it does not warn that disabling masking reduces privacy protection in logs, transcripts, screenshots, or shared outputs. This increases the chance of unnecessary exposure of personal data beyond what is needed for the lookup result.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

文件中的自然语言说明、用法提示和用户输出均固定为中文，没有提供语言切换、用户选择或说明该技能仅面向中文用户。这可能构成语言/locale 策略上的限制，特别是在面向通用用户环境时。

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.