ClawHub
Back to skill

Security audit

车辆尽调报告 Pro-标准版(AI付) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The vehicle-report workflow is coherent, but it asks users to run an unpinned installer that can enable payment and wallet capabilities, so it needs review before use.

Review the installer step before using this skill. Prefer a pinned, reviewed version of the Alipay payment package or a trusted managed installation path, and only proceed if you accept sending the VIN and vehicle details to Juhe and using Alipay for payment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:43
Finding

Unpinned npm Package Is Downloaded and Executed Automatically

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 43
Vulnerability Type: Supply-chain exposure through an unpinned runtime dependency
Risk Level: Medium

Vulnerable Code

text
- **If not installed**, prompt: use npx -y @alipay/agent-payment@latest install to install and activate the Alipay AI wallet capability, then enable the Alipay payment function

The original instruction invokes:

bash
npx -y @alipay/agent-payment@latest install

Technical Analysis

The Skill directs the user or Agent to download and execute the latest release of an npm package. The npx -y flags allow execution without an interactive package-installation review, while the @latest tag is mutable and can resolve to code different from the version assessed during this audit.

The instruction provides no immutable version, package integrity hash, lockfile, signature verification, or trusted-artifact validation procedure. Consequently, the effective code executed by this command is controlled by the package version available from the registry at invocation time.

This is an insecure dependency practice rather than evidence that the currently named package is malicious. The risk becomes exploitable if the package publisher account, npm registry delivery path, package maintenance process, or a future release is compromised.

Attack Path

  1. An attacker compromises the package publisher account or another part of the package publication pipeline.
  2. The attacker publishes a malicious release and assigns it to the mutable latest distribution tag.
  3. The payment dependency is absent in a target environment.
  4. The Skill presents or causes the user to follow the documented installation instruction.
  5. npx -y downloads the attacker-controlled release and executes its package lifecycle or command code without an interactive installation review.
  6. The malicious package runs with the permissions of the user or Agent process and may access resources ...[truncated 797 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed package version, for example:

    bash
    npx -y @alipay/agent-payment@X.Y.Z install

  2. Verify the package artifact against a documented integrity hash or trusted signature before execution.

  3. Use a lockfile and a trusted, explicitly configured npm registry where the deployment model permits it.

  4. Prefer installation during a controlled build or provisioning stage instead of downloading executable dependencies at runtime.

  5. Require explicit user approval that identifies the exact package, version, source registry, requested action, and security implications before installation.

  6. Disable or review dependency lifecycle scripts where feasible.

  7. Periodically audit the pinned version and update it only through a reviewed change-control process.

  8. Run the installation with least privilege in a sandboxed environment that cannot access unrelated credentials, sensitive files, or wallet state.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (7)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Line L004 states that user-facing content must use only Chinese column names, which imposes a language constraint on all output. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

Line L275 says the inspection section must be shown to the user in Chinese, reinforcing a mandatory single-language output policy. Because no user choice or clear region-specific justification is provided in this file, this conflicts with the language/locale policy criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Line L46 explicitly requires that user guidance must use Chinese options and forbids numeric replies, which imposes a language constraint on users. The file does not provide any opt-in, alternative locale, or justification that this is a region-specific requirement, so it fits the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README explicitly instructs the agent to present options to users in Chinese. This is a natural-language locale policy constraint that applies to all users, and the file does not indicate any user choice, opt-in, or region-specific justification for forcing Chinese.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The skill instructs installing and executing an unpinned package via npx -y @alipay/agent-payment@latest, which trusts whatever code is current at install time. If the upstream package is compromised, typosquatted, or a breaking release is published, users may execute unintended code with their local privileges during installation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The instructions explicitly require collecting user input '只用中文选项' and prohibit exposing English field names or numeric options. This imposes a language constraint on all users without offering a language choice or documenting a justified locale-specific limitation.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The skill transmits a VIN plus derived vehicle attributes to a third-party service, which is an external disclosure of user-supplied data. Even though the document limits fields and requires HTTPS, VINs and associated vehicle history can still be sensitive, and the skill relies on vendor-side handling that the user cannot verify.

Content

Scanner excerpt · SKILL.md (reported line 279)May include surrounding context.

向用户展示待查询摘要（VIN、车辆类型中文、事故是/否），严格遵守请求约束，向以下 URL 发起请求：

text
curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"862_pro","data":{"vin":"<规范化后的17位VIN>","type":<车型数字>,"hasSg":<0或1>}}' \
  -H "Content-Type: application/json"