自然人对外投资任职查询 - 聚合数据

• Outcome: Review
• Latest audit: Sep 8, 2026 · 7:54 AM UTC
• Version: 1.0.0

Overview

The skill appears to do the advertised lookup, but it handles national ID/mobile data in ways that can expose raw identifiers in logs and lacks clear consent/privacy guardrails.

Review before installing. Use this only when you are authorized to process the subject's identity and corporate-affiliation data, and assume the query sends name, national ID, and optional mobile number to juhe.cn. Do not pass keys or identifiers through command-line arguments, avoid shared transcripts/logs, and fix or disable the default raw JSON output before using it with real people.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/person_invest.py:313
• Finding: Unmasked personal information is exposed through the unconditional JSON output## Vulnerability Details **File Location**: `scripts/person_invest.py:139-151` and `scripts/person_invest.py:313-316` **Vulnerability Type**: Sensitive information exposure through application output **Risk Level**: High ### Vulnerable Code ```python return { "success": True, "orderid": payload.get("orderid", ""), "name": name, "idcard": idcard, "mobile": mobile or "", "total_count": len(items), "lp_count": relation_counts["lp"], "tm_count": relation_counts["tm"], "sh_count": relation_counts["sh"], "items": items, } ``` ```python result = query_person_invest(name, idcard, mobile, api_key) print(format_result(result)) print("") print(json.dumps(result, ensure_ascii=False, indent=2)) ``` ### Technical Analysis The result object retains the complete name, national ID number, optional mobile number, and all records returned by the external API. Although `format_result()` masks the primary identity fields in its human-readable report, the script immediately serializes and prints the original result object without redaction. Consequently, the masking operation does not provide effective protection. The raw JSON can contain the full national ID number, mobile number, name, API response metadata, corporate relationships, positions, and investment information. This also conflicts with the Skill documentation requiring identity information to be displayed in masked form. The exposure does not require code execution or elevated operating-system privileges. Any component capable of reading command output—including an Agent transcript, terminal logger, CI job, process supervisor, support diagnostic collector, or user with access to redirected output—can obtain the data. ### Attack Path 1. A user invokes the Skill with a real name, national ID number, and optionally a mobile number. 2. The external service returns the requested corporate relationship records. 3. `f ...[truncated 894 chars]
• Remediation: ## Remediation Suggestions 1. Remove the unconditional raw JSON output and print only the redacted result from `format_result()`. 2. If structured output is required, create a separate redaction function that copies the result and masks or removes `name`, `idcard`, `mobile`, and any sensitive API response fields before serialization. 3. Make raw output available only through an explicit, prominently documented debugging option, and avoid allowing raw output in normal Agent operation. 4. Prefer a safe structured-output mode that exposes only fields required for the declared business query. 5. Add automated tests asserting that complete ID card numbers and mobile numbers never appear in default standard output or error output. 6. Document that query output must not be retained in shared logs and apply restrictive permissions if output is written to a file.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:31
• Finding: API keys and personal identifiers can be exposed through command-line arguments## Vulnerability Details **File Location**: `SKILL.md:31-34` and `scripts/person_invest.py:8-12, 309` **Vulnerability Type**: Secret and personal-data exposure through process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # Method three: pass it on the command line for every invocation python scripts/person_invest.py --key YOUR_APP_KEY --name SAMPLE_NAME --idcard 110101199001011234 ``` ```python # Command-line argument example: # python person_invest.py --key your_api_key --name SAMPLE_NAME --idcard ID_NUMBER ``` ```python print(" 3. Command-line argument: python person_invest.py --key your_api_key --name SAMPLE_NAME --idcard ID_NUMBER") ``` ### Technical Analysis The documented and implemented interface permits the API key, real name, national ID number, and mobile number to be supplied through process arguments. Command-line arguments are not a suitable secret-input channel. Depending on the host environment, arguments may be visible in process listings, process telemetry, audit records, crash reports, shell history, orchestration metadata, or command-execution logs. The API key can therefore be recovered while the process is running or from retained history. Personal identifiers passed through the same interface are exposed through the same channels. Environment-variable and `.env` alternatives exist for the API key, so exposing it through `--key` is not necessary for the Skill's declared functionality. Likewise, sensitive query values could be collected through protected standard input or another non-argv channel. ### Attack Path 1. A user follows the documented example and starts the script with `--key`, `--name`, `--idcard`, and optionally `--mobile`. 2. The operating system, shell, Agent runtime, or monitoring software records the complete command line. 3. A local user, log reader, administrator of a shared execution service, or compromised monitoring component reads the arguments. ...[truncated 702 chars]
• Remediation: ## Remediation Suggestions 1. Remove `--key` from recommended usage and deprecate command-line secret input. 2. Load the API key from a protected configuration file or environment variable, and document restrictive file permissions such as owner-only read access. 3. Avoid passing national ID numbers and mobile numbers through argv. Read them from protected standard input or use an interactive prompt that does not retain history. 4. If backward compatibility requires command-line parameters, emit a security warning and clearly document the process-list and shell-history risks. 5. Ensure Agent integrations invoke the underlying function directly rather than constructing a shell command containing sensitive values. 6. Rotate any API key known to have been included in shared command history or logs.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/person_invest.py:296
• Finding: Rejected national ID and mobile values are echoed without masking## Vulnerability Details **File Location**: `scripts/person_invest.py:296-302` **Vulnerability Type**: Sensitive input disclosure through validation errors **Risk Level**: Low ### Vulnerable Code ```python if not validate_idcard(idcard): print(f"Error: invalid national ID number '{idcard}'; enter a valid 18-character national ID number") sys.exit(1) if mobile and not validate_mobile(mobile): print(f"Error: invalid mobile number '{mobile}'; enter a valid 11-digit mobile number") sys.exit(1) ``` ### Technical Analysis When validation fails, the script includes the complete rejected value in its error message. Mistyped values can still represent real or nearly complete national ID and mobile numbers, so failed validation does not make them non-sensitive. Error output is commonly retained by Agent transcripts, shell capture, monitoring systems, and CI logs. Unlike successful formatted results, these error paths do not call the masking helpers. An attacker cannot remotely trigger disclosure through this code alone, but a party with access to retained application output can recover the submitted value. ### Attack Path 1. A user enters a real identity value with a typographical error or unsupported formatting. 2. `validate_idcard()` or `validate_mobile()` rejects the input. 3. The script interpolates the complete rejected value into the error message. 4. The terminal, Agent runtime, or logging system retains the error. 5. A user with access to those logs reads the sensitive value. ### Impact Assessment The issue exposes rejected national ID or mobile values to parties able to access application output. It does not provide code execution, account privileges, or broader host access. The scope is limited to failed validation attempts, but repeated attempts can leave several variants of a person's identity information in logs.
• Remediation: ## Remediation Suggestions 1. Do not include the rejected value in validation errors; report only the expected format. 2. If identifying the input is operationally necessary, pass it through `mask_idcard()` or `mask_mobile()` before display. 3. Apply redaction consistently to standard output, standard error, exceptions, and structured logs. 4. Add tests confirming that validation failures cannot print complete ID card or mobile values. 5. Review upstream Agent and logging configurations to prevent sensitive input from being recorded before validation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill declares runtime requirements and clearly instructs use of environment variables, local files, and outbound API calls, but no explicit permission model is declared for those capabilities. This creates a transparency and governance gap: a host may invoke a skill that reads secrets and sends sensitive data externally without clear user-facing authorization boundaries.

Vague Triggers

Medium

• Confidence: 75% confidence
• Finding: The description includes broad trigger phrases such as '查股东', '尽职调查', and general employment/investment queries that may match ordinary conversation and invoke the skill unexpectedly. Because this skill processes highly sensitive personal data, accidental activation increases privacy risk and the chance of transmitting identity information to a third party without clear intent.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill asks for and transmits extremely sensitive personal data, including name, national ID number, and optionally phone number, to an external API, but the documentation does not provide a clear privacy notice, consent requirement, retention statement, or legal-use warning. In this context, missing disclosure is especially dangerous because the skill facilitates real-time third-party identity and corporate-affiliation lookup.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The script sends highly sensitive personal data—name, national ID number, and optionally phone number—to a third-party API. Although the transfer uses HTTPS, there is no explicit consent flow, privacy warning, minimization control, or retention guidance, which creates real privacy and compliance risk when used in an agent skill context.

Credential Access

High

• Category: Privilege Escalation

Content

export JUHE_PERSON_INVEST_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_PERSON_INVEST_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/person_invest.py --key 你的 AppKey --name 张三 --idcard 110101199001011234

• Confidence: 91% confidence
• Finding: The skill explicitly recommends passing the API key on the command line, which can expose the secret through shell history, process listings, audit logs, and terminal recording. This is a real credential-handling weakness because command-line arguments are commonly visible to other local users and operational tooling.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/person_invest.py:15