ClawHub
Back to skill

Security audit

自然人对外投资任职查询 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent identity-lookup purpose, but it handles national ID data and API credentials in ways users should review carefully before installing.

Install only if you have a legitimate, authorized reason to run China natural-person investment or appointment lookups. Treat the queried name, national ID number, mobile number, API key, and returned records as sensitive; avoid command-line keys, avoid GET URLs with real data, and do not run it where stdout is logged unless the raw JSON output is removed or redacted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/person_invest.py:141
Finding

Unmasked identity data is written to standard output

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/person_invest.py:251
Finding

API credentials and personal identifiers are accepted through process command-line arguments

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:72
Finding

Documentation recommends placing API credentials and identity data in a GET query string

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

The skill recommends storing the API key in a local .env file under the scripts directory. If that directory is readable by other tools, committed accidentally, or exposed through packaging/logging, the credential can be disclosed and abused for unauthorized API usage.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
# 方式一：环境变量（推荐，一次配置永久生效）
export JUHE_PERSON_INVEST_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_PERSON_INVEST_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入

Credential Access

High
Category
Privilege Escalation
Confidence
90% confidence
Finding

The example explicitly writes the secret into scripts/.env, normalizing a practice that can leak credentials through source control, backups, or accidental file reads. In a skill that already requires environment and file access, colocating secrets with executable assets increases exposure if the workspace is inspected or exfiltrated.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
export JUHE_PERSON_INVEST_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_PERSON_INVEST_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/person_invest.py --key 你的 AppKey --name 张三 --idcard 110101199001011234

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill instructs the agent to collect and transmit highly sensitive personal identifiers, including name and national ID number, to a third-party API without an explicit privacy warning, consent checkpoint, or data-handling limitation. Because the skill is specifically designed for personal-investment and employment linkage lookups, the privacy and compliance risk is materially elevated.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/person_invest.py (reported line 13)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python person_invest.py --key your_api_key --name 张三 --idcard 身份证号
    2. 环境变量：export JUHE_PERSON_INVEST_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_PERSON_INVEST_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/320
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/person_invest.py (reported line 308)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python person_invest.py --key your_api_key --name 张三 --idcard 身份证号
    2. 环境变量：export JUHE_PERSON_INVEST_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_PERSON_INVEST_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/320
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/person_invest.py (reported line 45)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The script sends highly sensitive personal identifiers including name, ID card number, and optionally mobile number to a third-party API. Although this is the intended function of the skill, there is no explicit user-facing consent, warning, or minimization notice before external disclosure, which creates significant privacy and compliance risk if users are unaware their PII is leaving the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

After formatting a partially masked summary, the script prints the full raw JSON result, which includes unmasked personal data and potentially extensive corporate relationship data. This can expose sensitive information to terminal history, logs, calling frameworks, or downstream systems that capture stdout.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding

The skill advertises capabilities that involve environment-variable access, file reading, and outbound network use, but it does not declare an explicit tool/permission scope. That weakens least-privilege controls and increases the chance the agent can access secrets or make network calls beyond what reviewers and runtime policy expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The trigger phrases are broad enough to activate on generic due-diligence or corporate-background requests, potentially causing the agent to invoke a high-sensitivity identity lookup skill when the user did not clearly request it. In context, that can lead to overcollection and transmission of personal data to a third-party API.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The natural-language docstring and command help are entirely Chinese, which effectively forces a specific language without user opt-in. The file does not state that the skill is intentionally limited to Chinese-speaking users or provide an alternate language option.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
72% confidence
Finding

All instructions, trigger phrases, examples, and outputs are presented exclusively in Chinese, which effectively imposes a language constraint. The file does not offer user opt-in for language preference or state that the skill is intentionally limited to a Chinese-language/regional audience for compliance reasons.

Content

No source excerpt is available for this finding.