ClawHub
Back to skill

Security audit

银行卡三要素核验 - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate verification purpose, but it handles bank and identity details in an unsafe, under-confirmed way.

Review before installing. Use only with explicit user consent to send full bank card, legal name, and ID number to Juhe. Do not use this version for real data unless the endpoint is changed to HTTPS or otherwise verified secure; avoid passing the API key on the command line or storing it in a repository-local .env file.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/verify_bankcard_three.py:25
Finding

Banking, identity, and credential data transmitted over plaintext HTTP

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Missing User Warnings

High
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill states it will send bank card number, real name, and national ID number to a third-party API, but it does not include a clear user-facing notice and consent requirement before transmission. This is especially dangerous because these are highly sensitive personal and financial identifiers, and disclosure to an external provider can create privacy, compliance, and misuse risks.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
84% confidence
Finding

The documentation explicitly recommends writing the API key into scripts/.env, a local file in the project tree. Storing credentials in a workspace file increases the chance of accidental exposure through source control, backups, logs, or other tools that can read files in the project, especially in agent environments with file-read capabilities.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
export JUHE_BANKCARD3_KEY=你的AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_BANKCARD3_KEY=你的AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/verify_bankcard_three.py --key 你的AppKey --bankcard 卡号 --realname 姓名 --idcard 身份证号

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARD3_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARD3_KEY=your_api_key
    3. 直接传参: python verify_bankcard_three.py --key your_api_key ...

免费申请 API Key: https://www.juhe.cn/docs/api/id/207

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_bankcard_three.py (reported line 12)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARD3_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARD3_KEY=your_api_key
    3. 直接传参: python verify_bankcard_three.py --key your_api_key ...

免费申请 API Key: https://www.juhe.cn/docs/api/id/207

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_bankcard_three.py (reported line 226)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_BANKCARD3_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_BANKCARD3_KEY=your_api_key
    3. 直接传参: python verify_bankcard_three.py --key your_api_key ...

免费申请 API Key: https://www.juhe.cn/docs/api/id/207

Missing User Warnings

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The script sends highly sensitive personal data and the API key to an HTTP endpoint using query parameters, exposing bank card numbers, names, ID numbers, and credentials to interception or modification by any network attacker on the path. In this skill context, the risk is elevated because the data is financial and identity-related PII, making confidentiality and integrity critical.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/verify_bankcard_three.py (reported line 40)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill performs sensitive operations including reading environment variables, local file access, and outbound network requests, but it does not declare an explicit tool scope or permissions boundary. In an agent setting, this weakens least-privilege controls and makes it easier for the skill to be invoked with broader capabilities than users or reviewers expect.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger description is broad and based on loose natural-language examples without clear exclusions or confirmation steps. Because this skill handles highly sensitive financial and identity data, overbroad triggering can cause accidental collection and transmission of personal information to a third party when the user did not intend to invoke this exact verification workflow.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The module docstring says python verify_bankcard_three.py --file data.csv # 批量核验, and later help text repeats the same capability, but the CLI parser has no branch for --file. This is an active contradiction between documentation and implementation, not merely missing detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The documentation explicitly encourages passing the API key via --key on the command line, which can expose the credential through shell history, process listings, logging, and job-control tooling. While this does not guarantee compromise on every system, it is an avoidable secret-handling weakness.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The manifest and module docstring both state that the skill supports 批量核验 and the help text advertises a --file mode, but the argument parser never handles a --file option and no CSV batch-processing logic is implemented. The actual code only performs a single verification request, so the delivered behavior is narrower than the stated functionality.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The runtime help lists --file as a supported parameter for CSV batch verification, yet the argument-parsing loop never recognizes --file, leaving file_path permanently unset. This causes the documented interface to diverge from the actual behavior users receive.

Content

No source excerpt is available for this finding.