Security audit

中国机动车驾驶证识别与抽取（ADP）

Security checks for vulnerabilities and agentic risk

Overview

The skill’s main driving-license workflow is understandable, but its bundled documentation exposes broader ADP CLI and custom-app administration capabilities than the narrow skill name suggests.

Install only if you trust Laiye ADP with driving-license images and extracted identity data. Prefer npm or a verified release over pipe-to-shell installers, restrict agent use to the driving-license OOTB app_id, avoid the generic parse/custom-app commands unless you intentionally need ADP administration, and protect both the API key and exported result files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The README advertises a general-purpose ADP document-processing CLI with capabilities far beyond Chinese driving-license recognition, including broad parsing, extraction, and app management. This scope mismatch is dangerous because an agent or user may invoke unintended capabilities under the guise of a narrowly scoped skill, increasing the attack surface and violating least-privilege expectations.

Description-Behavior Mismatch

Medium

Confidence: 97% confidence
Finding: The documented command set includes custom-app creation, update, and deletion operations, which exceed an extraction-only skill and enable state-changing actions against remote services. In an agent setting, this creates a capability-confusion risk where a supposedly read-oriented skill can be used to modify or delete resources, potentially causing unauthorized changes or destructive actions.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The README presents a general-purpose ADP CLI as suitable for AI Skill invocation, but the skill metadata claims a narrowly scoped driving-license extraction skill. This mismatch expands the operational surface area available to an agent, increasing the chance it invokes unrelated capabilities such as app management or broad document processing beyond the intended task.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The documented behavior covers broad parsing and extraction for many document types, while the manifest describes a driving-license-only skill. In an agent setting, this scope inflation can cause over-collection and processing of arbitrary documents, violating least privilege and enabling misuse outside the approved business purpose.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: Custom application create/update/delete features are unrelated to a fixed-purpose driving-license extraction skill and give an agent the ability to alter backend extraction behavior. That materially increases risk because an agent could create or modify apps to process new data types, change extraction targets, or disrupt service configurations.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: Configuration and account-related commands exceed the narrow purpose of a driving-license extraction skill and expose operational capabilities an agent does not need. In a skill context, unnecessary config access can enable endpoint switching, key misuse, or broader account introspection than intended.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The installation instructions tell users to fetch and immediately execute remote shell/PowerShell scripts via a pipeline without any integrity verification, pinning, or safety warning. This is dangerous because a compromised upstream repository, MITM in a misconfigured environment, or malicious script update would result in arbitrary code execution on the user's machine.

Missing User Warnings

Medium

Confidence: 84% confidence
Finding: The README instructs users to store API keys in environment variables or local configuration but does not warn about common credential exposure paths such as shell history, process inspection, CI logs, shared home directories, or accidental commits. In a skill that processes sensitive identity documents, leaked credentials could permit unauthorized access to document-processing APIs and associated data.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The installation instructions recommend fetching a remote script and piping it directly into a shell, with no integrity verification or warning. If the remote source, transport path, or upstream repository is compromised, users or automation could execute attacker-controlled code immediately.

Static analysis

No suspicious patterns detected.