中国居民户口本识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:26 AM UTC
• Version: 1.0.0

Overview

The skill is mostly coherent for household-register extraction, but it asks users to install a broad cloud document-processing CLI via unverified remote scripts and handle very sensitive identity documents with limited privacy warning.

Review before installing. Prefer the npm package or a pinned release with verification, and avoid running the curl-to-bash or PowerShell iex installer commands. Only use this skill for documents you are authorized to upload to Laiye ADP, because household registers contain identity numbers, addresses, family relationships, and other sensitive data. Check where outputs and API credentials are stored before using it in shared or regulated environments.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Mutable Remote Shell Script Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:63
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash

curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

Technical Analysis

The installation command retrieves a shell script from the mutable main branch of an external GitHub repository and pipes it directly to bash. The payload is neither included in the audited project nor pinned to an immutable commit or release. No checksum or cryptographic signature is verified before execution.

As a result, the effective code executed by this Skill can change after the Skill has been reviewed. HTTPS protects data in transit but does not protect against compromise of the upstream repository, maintainer credentials, release process, or GitHub account. The pipe also prevents users from reviewing the complete downloaded artifact before it begins executing.

Installing a CLI is necessary for the declared document-extraction workflow, but executing an unverified mutable script is not the minimum privilege or minimum trust mechanism required. A pinned and integrity-verified package or release artifact would provide the same functionality with substantially lower risk.

Attack Path

1. An attacker compromises a maintainer account, repository token, GitHub organization, or another mechanism capable of modifying the upstream main branch.
2. The attacker modifies scripts/adp-init.sh to include malicious shell commands.
3. A user or AI Agent follows the installation instructions in SKILL.md.
4. curl retrieves the attacker-controlled version of the script.
5. The pipe sends the content directly to bash without inspection or integrity verification.
6. The payload executes with all permissions available to the invoking user.

Impact Assessment

A successful attack permits arbitrary command execution with the privilege ...[truncated 607 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct curl | bash installation method.
2. Pin the installer or binary to an immutable release version or Git commit rather than the mutable main branch.
3. Publish SHA-256 checksums for release artifacts and require verification before execution.
4. Prefer cryptographically signed releases and verify the signature against a documented vendor key.
5. Download the artifact to a local file first, inspect and verify it, and only then execute it explicitly.
6. Prefer a pinned package-manager installation, such as a reviewed npm package version, rather than an unconstrained latest release.
7. Run installation with an unprivileged account and avoid sudo unless a specific, documented operation requires elevation.
8. Document what files, directories, network endpoints, and environment settings the installer changes.

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:30

Finding

README Recommends Direct Execution of a Mutable Remote Installer

Content

View full analysis

Vulnerability Details

File Location: README.md:30
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash

curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

Technical Analysis

The documented installation procedure downloads executable shell content from an external repository’s mutable main branch and immediately evaluates it with bash. The audited package does not contain the fetched installer, so its behavior cannot be established from the reviewed project. The command does not pin an immutable revision or perform checksum or signature validation.

This creates a time-of-review versus time-of-use supply-chain gap: a benign installer observed at one point can be replaced later without any modification to this project. Direct shell execution is not necessary to provide the declared document-recognition functionality and exceeds the minimum trust required for CLI installation.

Attack Path

1. An attacker obtains the ability to modify the referenced upstream installer.
2. Malicious commands are committed or otherwise served at the referenced main-branch URL.
3. A user copies the installation command from README.md.
4. The remote content is streamed directly into bash.
5. The attacker’s commands execute before the user can inspect or verify the complete payload.

Impact Assessment

The attacker obtains arbitrary code execution under the invoking account. Accessible scope may include the user’s files, local configuration, API keys, document inputs and outputs, environment variables, and network-accessible resources. Because the Skill processes household-registration records containing identity numbers, addresses, family relationships, and other sensitive personal information, compromise of the installation channel can lead to severe privacy and identity-related harm.

Root access is not automatically ...[truncated 144 chars]

Remediation

View remediation

Remediation Suggestions

1. Delete the pipe-to-shell example from the README.
2. Replace it with installation from a version-pinned package or immutable release artifact.
3. Require SHA-256 checksum validation and preferably cryptographic signature verification.
4. Provide a download-verify-execute sequence rather than streaming network content into a shell.
5. Pin the recommended npm package to a known reviewed version.
6. Publish a security policy describing the release-signing process and supported artifact hashes.
7. Warn users not to install the CLI with elevated privileges unless strictly required.

T03 · Remote Payload Retrieval and Execution

Error

• Location: README-CN.md:29

Finding

Chinese README Recommends Unverified Remote Code Execution

Content

View full analysis

Vulnerability Details

File Location: README-CN.md:29
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

bash

curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

Technical Analysis

This installation command executes content obtained from a mutable external URL without first storing, reviewing, pinning, or validating it. The URL follows the repository’s main branch, allowing the effective installer to change independently of the audited Skill.

The vendor-named GitHub organization and use of HTTPS provide some provenance and transport assurance, but they do not establish payload integrity against repository takeover, credential compromise, malicious upstream changes, or release-process compromise. The external installer was not included in the project, so its current or future behavior cannot be validated by this audit.

This mechanism exceeds the minimum privileges and trust necessary for the Skill’s declared functionality. The Skill only needs a functional CLI; it does not require automatic execution of mutable network content.

Attack Path

1. An attacker compromises the upstream source repository or an authorized maintainer.
2. The attacker inserts credential theft, document collection, persistence, or another payload into adp-init.sh.
3. A user follows the command in README-CN.md.
4. The modified script is downloaded and passed directly to bash.
5. Malicious commands run with the permissions of the invoking user and can access resources available in that execution context.

Impact Assessment

Exploitation enables arbitrary command execution as the current user. The attacker could access ADP credentials, sensitive identity documents, generated extraction results, shell configuration, SSH material, and other readable data. The payload could alter files and install persistent components where user per ...[truncated 251 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the direct remote-script execution instruction.
2. Reference an immutable, versioned release rather than the main branch.
3. Publish checksums and signed attestations for every supported artifact.
4. Require users to download and verify the file before executing it.
5. Keep all language variants synchronized so insecure instructions are not retained in translated documentation.
6. Recommend least-privileged installation and clearly document any operation that genuinely requires elevation.
7. Where npm is used, specify a reviewed package version and document package provenance.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of | bash is a classic command-chaining abuse pattern because it sends unreviewed network content directly into a command interpreter. This removes the opportunity for inspection and magnifies the risk of arbitrary command execution if the fetched content is altered or malicious.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a broad, general-purpose document-processing CLI with parsing, extraction, batch processing, and agent-oriented automation rather than a narrowly scoped household-register recognition skill. This scope mismatch is dangerous because it can cause an agent or user to invoke capabilities far beyond the declared purpose, increasing the chance of unintended data access, processing of arbitrary documents, and misuse in higher-privilege workflows.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README exposes custom application creation, editing, and management features that are unrelated to a fixed-function household-register extraction skill. In an agent context, these capabilities broaden the tool from passive extraction into configurable workflow creation, which can be abused to process arbitrary document types or alter behavior outside the reviewed security boundary.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Piping a remotely fetched script directly into bash creates an immediate code-execution chain with no review or integrity validation step. In an agent or automation setting, this pattern is especially dangerous because it normalizes executing untrusted network content, which can fully compromise the machine or steal credentials and sensitive household-registration data.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to send highly sensitive household-registration data, including ID numbers, addresses, religion, and family relationships, to a remote third-party ADP service but does not present a clear upfront privacy or data-transfer warning. In this context, users may unknowingly exfiltrate regulated personal data off-device, creating compliance, confidentiality, and consent risks.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The '| bash' construct is a classic chaining pattern that turns a network fetch into immediate shell execution, collapsing review and execution into one step. In a skill that users may follow verbatim, this materially raises the chance of arbitrary command execution if the fetched content is malicious or tampered with.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README describes a broad, general-purpose ADP document-processing CLI rather than a narrowly scoped household-register extraction skill. This scope mismatch is dangerous because an agent or operator may invoke capabilities far beyond the declared purpose, increasing the chance of unintended data access, document exfiltration, or misuse under a misleadingly narrow skill label.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions include piping remotely fetched scripts directly into a shell/PowerShell interpreter without any integrity verification or safety warning. If the source, transport, upstream repository, or user environment is compromised, this pattern can lead to immediate arbitrary code execution on the host running the skill setup.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented commands allow generic parse/extract operations on arbitrary local files, remote URLs, and base64 content, which exceeds the declared household-register-only behavior. In an agent setting, this creates a confused-deputy risk where a seemingly specialized skill can be used as a general document ingestion and extraction tool against unintended sensitive inputs.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README advertises custom application lifecycle management such as create, update, and delete for extraction apps, which is unrelated to the skill's stated purpose. Exposing administrative functions inside a narrowly branded extraction skill expands the attack surface and could let an agent modify processing configurations or create new extraction behaviors beyond intended controls.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documented commands include setting API keys and base URLs, clearing config, listing apps, and checking remaining credits. These are service-administration capabilities for the broader ADP platform and are not part of the core intent of extracting structured data from household registers.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

Documenting remote URL processing extends the skill from local household-register recognition to fetching and processing arbitrary remote files. That increases SSRF-style exposure, unreviewed third-party data handling, and accidental transmission of sensitive identity documents to external services, which is especially concerning given the PII-heavy household-register context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README instructs users to process remote documents and export results locally without clearly disclosing that documents may be transmitted to a cloud service and that extracted data will be written to local files. Because household registers contain highly sensitive personal data, missing privacy and storage warnings materially increase the risk of unintentional disclosure or insecure handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill recommends shell and PowerShell one-liners that fetch code from the internet and immediately execute it, without verification or a warning about the trust boundary. This creates a software supply-chain risk: if the remote script or delivery path is compromised, users could execute arbitrary code on their machines.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The README explicitly fetches and executes an external shell script from GitHub, creating a direct supply-chain and remote code execution pathway. In the context of an agent skill, operators may trust the documentation and run the command verbatim, making compromise of the remote script source especially dangerous.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The README recommends installing via a shell command that fetches a script directly from the internet at execution time. This is dangerous because users cannot verify the script contents or integrity before running it, and any compromise of the remote source or delivery path could lead to arbitrary code execution on the host.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The skill description and operating instructions are entirely in Chinese, which effectively forces a specific language experience. The file does not offer an opt-in language choice or explicitly justify that the skill is intended only for Chinese-speaking users despite being a general skill description.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command uses curl to retrieve a remote script and pipes it directly into bash, which bypasses inspection and executes whatever content is served at runtime. Any compromise of the source repository, maintainer account, CDN path, or TLS trust chain could turn this into immediate arbitrary code execution on the user's host.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination