中国居民身份证识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.1

Overview

The skill has a coherent ID-card extraction purpose, but its setup and usage instructions create review-worthy risk by combining sensitive identity-document uploads with unverified remote installer execution and broad CLI capabilities.

Review this skill carefully before installing. Prefer a pinned, verified npm or release install and avoid the curl-to-bash or PowerShell iex methods. Only use it with ID documents you are authorized to process, because images, URLs, Base64 content, extracted fields, and API-key-authenticated requests are handled by Laiye ADP cloud endpoints. Limit agents to the ID-card extraction commands and avoid exposing the broader custom-app administration commands unless you explicitly need them.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:60

Finding

Unverified remote installation scripts are executed directly by the shell

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:54

Finding

Globally installed npm CLI is not pinned to an audited version

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The | bash chaining pattern is especially dangerous because it converts downloaded content directly into shell execution with no opportunity for inspection or validation. In the context of an agent skill, this can normalize unsafe command execution patterns and lead to immediate host compromise if the fetched content is malicious or tampered with.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping the output of a network request directly into bash removes any opportunity for inspection and turns remote content into immediate shell execution. This chaining pattern is especially risky in an AI-skill context because it normalizes an unsafe one-liner that could be repeated automatically or by less experienced users, resulting in full host compromise if the script source is malicious or tampered with.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented command set includes remote URL ingestion, batch async processing, generic parsing, and custom application management, all of which go well beyond an ID-card extraction skill. In an agent setting, this expands the operational surface from a narrowly bounded OCR task to a general document-processing tool that could be directed at arbitrary local or remote content, increasing the risk of overcollection, unintended network access, and misuse of privileged automation paths.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Create, update, and delete operations for custom extraction applications are administrative capabilities unrelated to a consumer skill for ID-card recognition. Exposing lifecycle-management actions inside a narrowly scoped skill violates least privilege and could allow an agent or user to alter extraction logic, remove configurations, or pivot into broader tenant administration if these commands are reachable.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping curl output directly into bash is especially dangerous because it combines download and execution in a single step, eliminating opportunities for validation, review, or integrity checks. In this skill's context, the command is presented as a normal installation path, making accidental execution by users or agents more likely and increasing the chance of remote code execution if the upstream content is tampered with.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes a broad, general-purpose ADP CLI capable of parsing arbitrary local files, remote URLs, Base64 payloads, async task handling, app management, and custom app lifecycle operations, which materially exceeds the skill's declared purpose of Chinese ID card recognition. This scope mismatch increases the chance that an agent or user will invoke capabilities unrelated to the intended task, including sending unexpected documents to a cloud service or performing broader operations than the skill manifest suggests.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation section recommends fetching and immediately executing remote shell and PowerShell scripts without any integrity verification, signature checking, pinning to a specific release, or review step. If the remote source, transport path, or upstream repository is compromised, users can execute attacker-controlled code directly on their systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README instructs users to process local documents, remote URLs, and Base64 content via a public cloud ADP service but does not clearly warn that document contents may leave the local environment and be transmitted to third-party infrastructure. Because this skill targets identity documents containing highly sensitive PII, insufficient disclosure materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README positions this skill as a general-purpose ADP document-processing CLI with broad parsing and extraction capabilities, which materially exceeds the declared skill scope of Chinese resident ID-card recognition and 8-field extraction. Scope mismatch is dangerous because an agent or user may invoke capabilities on arbitrary documents or workflows, causing unintended data access, exfiltration, or misuse beyond the expected least-privilege function.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README recommends installation via fetched shell and PowerShell scripts executed directly from the network, without any integrity verification, pinning, or warning. This is dangerous because compromise of the source repository, network path, or referenced script can lead to arbitrary code execution on the installing host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload Chinese ID card images and extracted identity fields to a remote ADP service, but it does not prominently warn that this transfers highly sensitive personal data off-device. Because the data includes government ID numbers, addresses, birth dates, and issuing authority, omission of a clear privacy/transmission notice can cause users or downstream agents to send regulated PII without informed consent or proper handling safeguards.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The documented command uses curl to fetch a remote script and immediately execute it, creating a classic external-script-fetching risk. This pattern bypasses normal review controls and makes compromise of the hosting location or repository equivalent to arbitrary code execution on the user's machine.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The command fetches a remote script from GitHub and executes it locally, creating a direct arbitrary-code-execution path if the remote content is altered or intercepted. In the context of an agent skill, surfacing this pattern in setup documentation is more dangerous because users may copy it verbatim and grant the tool broad host-level execution during installation.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The skill recommends fetching an installation script directly from the internet and executing it immediately. This creates a supply-chain risk: if the source repository, network path, or referenced script is compromised, users will run attacker-controlled code on their systems without review or integrity verification.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination