ClawHub
Back to skill

Security audit

VIN 查询车辆信息-精准版(AI付) - 聚合数据

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly coherent for a paid VIN lookup, but it asks users to install and enable payment capabilities through an unpinned npx package.

Before installing, confirm you trust the Alipay payment package source and prefer a pinned, reviewed package version instead of `@latest`. The VIN lookup data flow itself is disclosed, but enabling wallet/payment functionality is a high-impact setup step.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:37
Finding

Execution of an Unpinned Mutable Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 37
Vulnerability Type: Supply-chain risk from automatic execution of an unpinned package
Risk Level: Medium

Vulnerable Code

text
- **If not installed**, prompt: use npx -y @alipay/agent-payment@latest install to install and enable the Alipay AI wallet capability, then enable the Alipay payment function

The original instruction contains this executable command:

shell
npx -y @alipay/agent-payment@latest install

Technical Analysis

The Skill instructs the agent to recommend npx -y execution of @alipay/agent-payment@latest. The latest tag is mutable and therefore does not identify the exact package release that was reviewed. The -y option suppresses the normal confirmation prompt, reducing the opportunity to inspect the resolved package version before its code runs.

When invoked through npx, downloaded package CLI code and applicable package lifecycle behavior execute with the privileges of the user running the agent. The project does not pin an exact version, verify a cryptographic integrity value, or establish a reviewed lockfile for this installation path.

This is a supply-chain weakness rather than evidence that the currently published package is malicious. Exploitation depends on compromise or malicious modification of the package, its publishing account, the registry resolution path, or a future release assigned to latest.

Attack Path

  1. An attacker compromises the package, its publisher account, or the relevant registry distribution path.
  2. The attacker publishes a malicious release and causes @alipay/agent-payment@latest to resolve to it.
  3. A user without the required dependency invokes the Skill.
  4. The Skill prompts execution of npx -y @alipay/agent-payment@latest install.
  5. npx downloads the mutable package release and runs its CLI code without an interactive package-installation confirmation.
  6. The malicious code executes under t ...[truncated 733 chars]
Remediation
View remediation

Remediation Suggestions

  1. Replace @latest with an exact, reviewed version:

    shell
    npx @alipay/agent-payment@X.Y.Z install

  2. Do not use -y for first-time execution. Require explicit user confirmation after displaying the package name, exact version, registry source, and requested operation.

  3. Verify the package against a trusted cryptographic integrity value or signed provenance before execution.

  4. Resolve and review dependencies through a lockfile or an equivalent reproducible installation mechanism.

  5. Restrict package retrieval to an approved registry and consider organizational package allowlisting.

  6. Run the installer with the least-privileged account possible and avoid administrator or root execution.

  7. Establish a controlled update process in which newer releases are reviewed and tested before the pinned version is changed.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (3)

Rp1

Medium
Category
MCP Rug Pull
Confidence
92% confidence
Finding

The skill instructs installation via npx -y @alipay/agent-payment@latest, which fetches and executes the latest package version at runtime without pinning to a known-good release. This creates a supply-chain risk: if the package is compromised or a breaking/malicious update is published, users could execute unreviewed code during setup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The privacy/consent flow explicitly instructs the user to reply with specific Chinese affirmations such as「确认」「好的」「可以」「继续」「同意」「下一步」or「取消」to proceed or stop. This imposes a language-specific interaction pattern without any opt-in or alternative locale handling, which is a natural-language locale policy concern.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 150)May include surrounding context.

向用户展示待查询的参数，严格遵守请求约束，向以下 URL 发起请求：

text
curl https://apis.juhe.cn/a2a/query \
  -d '{"resourceId":"862","data":{"vin":"<用户输入的VIN码>"}}' \
  -H "Content-Type: application/json"