Security audit

港澳台通行证识别与抽取（ADP）

Security checks across malware telemetry and agentic risk

Overview

The skill likely performs the promised permit extraction, but it also includes broader ADP CLI/admin guidance and handles sensitive identity documents through a cloud service without enough scoping or privacy detail.

Review before installing. Use this only if you are authorized to send Hong Kong/Macau permit images and extracted ID fields to Laiye ADP cloud services. Prefer npm or verified release artifacts over pipe-to-shell installers, protect the ADP API key, and avoid giving agents permission to use broader custom-app or deletion commands unless you intentionally need those administrative ADP features.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The README describes a broad, general-purpose ADP CLI with multi-document parsing and extraction workflows rather than a narrowly scoped Hong Kong/Macau permit-recognition skill. This scope mismatch is dangerous because an agent or user may grant broader capabilities than expected, enabling unintended document access, processing, or workflow expansion beyond the manifest’s stated purpose.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The README advertises remote URL processing, asynchronous task handling, and batch export features that exceed a dedicated extraction-only skill’s expected scope. In an agent environment, these extra capabilities can widen the attack surface by allowing retrieval of remote content, persistence of task metadata/results, and processing at larger scale than users may have consented to.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: Exposing custom application creation, update, deletion, and AI-generated schema capabilities is unjustified for a fixed-purpose permit-recognition skill and materially increases privilege and behavioral flexibility. This is dangerous because it can let an agent reconfigure extraction logic or pivot into arbitrary document-processing use cases, defeating the principle of least privilege.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README materially mismatches the skill manifest: it describes a broad, general-purpose ADP CLI for parsing and extracting many document types rather than a narrowly scoped Hong Kong/Macau permit extractor. This kind of scope inflation is dangerous because agents or users may grant broader trust, permissions, or data access than intended, increasing the risk of over-collection, unintended document processing, and misuse of a supposedly specialized skill.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Exposing custom application creation, editing, and management goes well beyond the stated purpose of fixed-field permit recognition. In an agent skill context, this expands the operational surface from a bounded extractor into a configurable platform interface, which can enable unexpected actions, broader data handling, and privilege misuse if consumers rely on the manifest's narrow description.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The installation instructions tell users to execute remote shell and PowerShell scripts directly from the network without verification, integrity checks, or safety warnings. If the upstream source, transport path, or referenced repository is compromised, this becomes immediate arbitrary code execution on the user’s machine.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README instructs users to pipe remote shell and PowerShell scripts directly into an interpreter without any integrity verification or warning. This is dangerous because any compromise of the source repository, network path, or referenced script can lead to immediate arbitrary code execution on the user's machine during installation.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The skill processes highly sensitive identity-document data and instructs users to send local files, URLs, and Base64-encoded permit images to an external ADP service, but it does not prominently warn users about third-party transmission, retention, or compliance implications. In this context, the omitted privacy disclosure is more dangerous because the documents contain government ID details and machine-readable codes that can be misused for identity fraud or regulatory violations if handled without informed consent.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.