Security audit

车辆尽调报告 Pro-标准版(AI付) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed paid vehicle-report workflow that sends limited vehicle details to a fixed third-party API after user consent and payment confirmation.

Before installing, be comfortable with a paid workflow that shares the VIN and vehicle-related query details with Juhe and uses Alipay payment skills. Do not use it for non-due-diligence lookups, and verify the payment amount and consent notice before confirming a query.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README instructs agents to send VIN, vehicle type, and accident/illegal-modification status to an external API, but it does not clearly require a user-facing disclosure that this data will be shared with a third-party service as part of a paid transaction. Even though it says not to collect phone numbers or IDs and requires plate masking on output, the transmitted and returned data is still sensitive vehicle/registration information that can affect user privacy and informed consent.

Static analysis

No suspicious patterns detected.