营业执照识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:51 AM UTC
• Version: 1.0.0

Overview

This skill is a cloud business-license extraction helper, but it includes unsafe remote-script installer commands and broader CLI/admin capabilities that need review before installation.

Review before installing. Prefer the npm or signed release path, avoid running the curl | bash or irm | iex commands, confirm your organization permits uploading business licenses and extracted PII to Laiye ADP, and keep the agent limited to the OOTB business-license extraction commands rather than the broader custom-app/admin CLI features.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:64

Finding

Mutable Remote Shell Script Is Downloaded and Immediately Executed

Content

View full analysis

Remediation

View remediation

``` 3. If a shell installer must remain available: - Link to an immutable release artifact or commit rather than `main`. - Download the script without executing it. - Publish its expected SHA-256 checksum through a separately controlled channel. - Verify the checksum before execution. - Encourage users to inspect the downloaded script. - Execute it without elevated privileges unless a specific operation demonstrably requires elevation. Example pattern: ```bash curl -fL -o adp-init.sh "https://example.invalid/releases//adp-init.sh" printf '%s %s\n' '' 'adp-init.sh' | sha256sum -c - less adp-init.sh bash adp-init.sh ``` 4. Cryptographically sign release artifacts and document signature verification. 5. Document what files, directories, network endpoints, and permissions the installer uses. 6. Instruct AI Agents to obtain explicit user approval before installing software or executing downloaded content. ]]>

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:69

Finding

Mutable Remote PowerShell Script Is Downloaded and Immediately Evaluated

Content

View full analysis

Remediation

View remediation

/adp-init.ps1" ` -OutFile ".\adp-init.ps1" if ((Get-FileHash ".\adp-init.ps1" -Algorithm SHA256).Hash -ne "") { throw "Installer checksum verification failed." } Get-AuthenticodeSignature ".\adp-init.ps1" Get-Content ".\adp-init.ps1" & ".\adp-init.ps1" ``` 4. State the installer's expected filesystem, registry, network, and privilege changes. 5. Require explicit user consent before an AI Agent installs the CLI or executes any downloaded script. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping curl output directly into bash is a classic command-chaining hazard because it removes opportunities for inspection and turns any upstream compromise into immediate code execution. In a skill context, this is especially risky because an agent or user may treat README commands as trusted automation steps.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash pattern is a classic command-chaining anti-pattern that turns a network response into immediate code execution without inspection. In an agent skill context, this is especially dangerous because automated systems may reproduce the exact command non-interactively, amplifying supply-chain and remote code execution risk.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The explicit command chain using '| bash' turns remote content retrieval directly into command execution, eliminating any opportunity for inspection or integrity validation. In the context of an installation step for a broadly reusable skill, this is especially dangerous because users are likely to run it verbatim, amplifying supply-chain and command-execution risk.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README presents a broad, general-purpose ADP document-processing CLI while the skill metadata claims a narrowly scoped business-license extraction skill. This scope mismatch can cause an agent or user to invoke capabilities far beyond the advertised purpose, increasing the attack surface and enabling unintended document parsing, extraction, or external service use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Application management capability is not justified by the skill's declared business-license extraction use case. In context, this makes the skill more dangerous because an agent expecting a single-purpose extractor may gain broader control-plane actions over apps and processing behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README encourages processing remote URLs and cloud-based document extraction without a clear warning that document contents are transmitted to an external ADP service. This can lead users or agents to send sensitive licenses, IDs, or regulated business documents off-platform without informed consent, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented custom application lifecycle commands (create, update, delete, version management) exceed the stated purpose of recognizing and extracting fields from business licenses. Exposing administrative features in a narrowly scoped skill creates unnecessary privilege and functionality, which can be misused by an agent to modify remote extraction apps or configurations.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a broad, general-purpose ADP CLI with autonomous planning, generic document parsing, and multi-scenario extraction rather than a narrowly scoped skill for Chinese business-license recognition. This scope mismatch can mislead agents or users into invoking capabilities that exceed the declared purpose, increasing the chance of unintended data handling, privilege expansion, or unsafe tool use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting custom application creation, editing, and management exposes functionality unrelated to simple business-license extraction and materially broadens what an agent could do. In a skill context, this can enable reconfiguration of extraction logic or interaction with other enterprise document workflows beyond the user's expected consent boundary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README shows processing remote URLs and exporting outputs locally without clearly warning that document contents may be fetched from external locations, transmitted to Laiye's public cloud service, and stored on disk. For business licenses and related corporate documents, this omission can lead to unintentional disclosure of sensitive business or personal information and unsafe local persistence.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill description and operational guidance are entirely in Chinese, with no indication that users may choose another language for interaction. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly documented and justified.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload business-license images and receive extracted structured data from an external ADP cloud service, but it does not clearly warn that potentially sensitive business and personal information will leave the local environment. This creates privacy, compliance, and data-governance risk because users may transmit regulated data without informed consent or appropriate approval.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

L475、L479、L480 的说明分别提到“驾驶证证号”“驾驶证应用的 app_id”以及“file_number 档案编号”，这与全文其余部分声明的营业执照抽取能力直接矛盾。此类复制粘贴残留会误导使用者对技能处理的数据类型、PII 范围和字段兼容逻辑的理解。

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 99% confidence

Finding

The installation instructions fetch and execute a remote shell script directly from the network. If the source repository, delivery path, or transport endpoint is compromised, users may execute arbitrary attacker-controlled code immediately on their system.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The documented 'Task Query' capability and later 'credit' command support operational querying of asynchronous jobs and account credits, which are ancillary platform-management functions rather than business-license recognition itself. While useful for a CLI, they are not clearly justified by the narrowly stated manifest purpose.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The installation instruction pipes a remotely fetched script directly into a shell, which executes whatever content is served at that URL at install time. If the source repository, network path, or delivery chain is compromised, users or agents can be induced to run arbitrary code on their systems.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The README advertises remote URL ingestion even though the skill is presented as a business-license extraction tool. Allowing arbitrary URL-based input expands the trust boundary, can cause unintended retrieval and transmission of third-party documents to the cloud service, and may surprise users who expect only local document handling.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill recommends fetching and immediately executing a remote shell script from GitHub with curl-pipe-to-bash. If the remote content, upstream repository, distribution path, or network channel is compromised, arbitrary code will run on the user's machine with the user's privileges.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This markdown file contains natural-language policy text binding disputes to the laws of the People's Republic of China and the licensor's local court. Under the stated policy criteria, forcing a specific locale without user opt-in or an explicit justification can constitute a language/locale policy concern.

Content

No source excerpt is available for this finding.