ClawHub
Back to skill

Security audit

VIN查车辆信息(精准版) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent VIN lookup skill that sends a user-provided VIN and Juhe API key to the documented Juhe API, with some credential-handling cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable sending VINs to Juhe for lookup and with Juhe billing or quota use. Prefer setting JUHE_VIN_CAR_DETAIL_KEY as an environment variable or a protected local secret file, avoid passing the key with --key or in GET URLs, and rotate the Juhe key if it was previously exposed in command history or logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/vin_info.py:198
Finding

API Credential Exposure Through Command-Line Arguments

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Credential Access

High
Category
Privilege Escalation
Confidence
93% confidence
Finding

The documentation suggests passing the API key directly on the command line via --key. Command-line arguments are commonly exposed through shell history, process listings, logs, and telemetry, which can leak the credential to other local users or monitoring systems and enable unauthorized API use.

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md
export JUHE_VIN_CAR_DETAIL_KEY=你的 AppKey

# 方式二：.env 文件（在脚本目录创建）
echo "JUHE_VIN_CAR_DETAIL_KEY=你的 AppKey" > scripts/.env

# 方式三：每次命令行传入
python scripts/vin_info.py --key 你的 AppKey --vin LBV21AF05MSZ88595

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 29)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python vin_info.py --key your_api_key --vin LBV21AF05MSZ88595
    2. 环境变量：export JUHE_VIN_CAR_DETAIL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_VIN_CAR_DETAIL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/862
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vin_info.py (reported line 12)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python vin_info.py --key your_api_key --vin LBV21AF05MSZ88595
    2. 环境变量：export JUHE_VIN_CAR_DETAIL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_VIN_CAR_DETAIL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/862
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vin_info.py (reported line 225)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 命令行参数：python vin_info.py --key your_api_key --vin LBV21AF05MSZ88595
    2. 环境变量：export JUHE_VIN_CAR_DETAIL_KEY=your_api_key
    3. 脚本同目录的 .env 文件：JUHE_VIN_CAR_DETAIL_KEY=your_api_key

申请 API Key: https://www.juhe.cn/docs/api/id/862
"""

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/vin_info.py (reported line 91)May include surrounding context.

python
if env_key:
        return env_key

    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares capabilities that imply reading environment variables, local files, and making network requests, but it does not declare an explicit tool scope or allowed-tools boundary. This creates a permission transparency problem: the runtime may permit broader actions than users or reviewers expect, increasing the chance of overreach or misuse if the skill is invoked unexpectedly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The trigger phrases are broad enough that the skill may activate on general automotive questions like '排量排放' or '查车型配置' without a clear requirement that the user intends a VIN lookup. Unintended activation is risky here because invocation can transmit a VIN or prompt the agent to collect and send identifying vehicle data to a third-party API, potentially incurring cost as well.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The description does not disclose that the user's VIN will be sent to Juhe, a third-party service, for lookup. VINs are sensitive identifiers that can be linked to a specific vehicle and sometimes an owner context, so omitting this notice undermines informed consent and can cause privacy and compliance issues.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The module docstring, usage instructions, and user-facing help/messages are all presented only in Chinese. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.