开户许可证识别与抽取（ADP）

• Outcome: Review
• Latest audit: May 28, 2026 · 9:02 AM UTC
• Version: 1.0.1

Overview

This appears to be a legitimate ADP document-extraction skill, but it needs review because it handles sensitive banking documents through a broad cloud CLI with under-scoped documentation and risky installer examples.

Review before installing. Use this only if you are authorized to send account-opening permits and extracted banking/business data to Laiye ADP cloud services. Prefer npm or verified release installation over the remote script commands, restrict agent use to the permit extraction commands, avoid custom-app management unless you intentionally need admin privileges, and store exported JSON results in a protected location.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The README describes a broad, general-purpose ADP CLI with parsing, extraction, task management, and application management capabilities that substantially exceed the declared skill purpose of only recognizing and extracting fields from Chinese account-opening permits. This creates a scope mismatch that can mislead an agent into invoking more powerful functionality than users expect, increasing the attack surface and enabling unintended document access or workflow actions.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The documented `custom-app create`, `update`, and `delete` commands give the agent access to modify server-side extraction applications, which is far beyond a read/extract-only skill. In an agent setting, this can lead to unauthorized configuration changes, destructive actions, or persistence mechanisms under the guise of document extraction.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The README describes a broad, general-purpose ADP CLI with parsing, extraction, app management, async workflows, and billing features that materially exceed the declared skill scope of Chinese account-opening permit recognition. In an agent-skill context, this scope mismatch is dangerous because it can cause an agent to invoke capabilities unrelated to the intended task, increasing the chance of overbroad data access, unintended network transmission, or misuse of administrative functions.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Documenting custom application creation, editing, and management inside a skill that is supposed to only recognize and extract fields from account-opening permits exposes privileged, out-of-scope functionality. In an agent environment, these capabilities could be chained to alter extraction logic, create arbitrary apps, or mutate service-side configuration beyond the user’s expected intent.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Remote URL processing expands the trust boundary beyond local user-supplied documents and enables the skill to fetch and transmit content from arbitrary locations. This can lead to unintended access to external resources, privacy issues, or agent misuse if a prompt or workflow supplies attacker-controlled URLs.

Context-Inappropriate Capability

Low

• Confidence: 79% confidence
• Finding: Credit and billing inspection is not needed for document field extraction and represents unnecessary scope expansion. While lower impact than execution or configuration features, exposing account-usage metadata in a narrowly scoped skill can still leak operational or billing information to unintended consumers.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README encourages parsing and extracting from local files and URLs using a public cloud service but does not clearly warn that document contents may be transmitted off-host for processing. For sensitive business documents such as permits, bank account details, and legal representative information, this omission can cause users or agents to send regulated or confidential data without informed consent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README presents one-line shell and PowerShell install commands that download and immediately execute remote scripts, but it gives no warning about the risks of running fetched code. In an agent or automation setting, this pattern can lead to arbitrary code execution on the host if the remote content, repository, or delivery path is compromised.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill processes highly sensitive banking and identity-bearing documents by sending them to an external ADP cloud service, but the document does not present a prominent upfront privacy warning, consent expectation, or data-handling summary before use. In this context, the data includes bank account numbers, legal representative names, and company details, making undisclosed remote transmission materially risky from a privacy, compliance, and data-governance perspective.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.