护照识别与抽取（ADP）

• Outcome: Review
• Latest audit: May 28, 2026 · 8:21 AM UTC
• Version: 1.0.0

Overview

This skill is mainly a cloud passport-extraction helper, but it packages broader ADP administration/document-processing guidance and risky installer examples that users should review before use.

Install only if you intend to use Laiye ADP's cloud service for passport data and have authorization to process those passports. Prefer npm or reviewed release downloads over pipe-to-shell installers, restrict the agent to passport-specific extract commands and the OOTB passport app ID, avoid the custom-app/admin commands unless explicitly needed, and handle API keys and exported passport results as sensitive data.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The README describes a general-purpose ADP CLI with broad document parsing, extraction, task handling, and app management capabilities that materially exceed the declared skill purpose of Chinese passport recognition/extraction. This scope mismatch is dangerous because an agent or user may trust the manifest and unknowingly grant or invoke far broader functionality than intended, increasing the chance of unauthorized data handling or misuse.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: Documenting commands to create, update, and delete custom extraction applications expands the effective capability of the skill beyond passport-field extraction into administrative control over extraction workflows. In a skill context, this can mislead an orchestrating agent into performing privileged or destructive actions unrelated to the advertised task.

Description-Behavior Mismatch

Medium

• Confidence: 89% confidence
• Finding: The README advertises arbitrary local file, URL, and base64 processing across general document types rather than only Chinese passport pages. This broadens the operational scope and can lead to unintended ingestion of unrelated or sensitive documents under the guise of a narrowly scoped identity-document skill.

Context-Inappropriate Capability

High

• Confidence: 92% confidence
• Finding: Custom application lifecycle management is context-inappropriate for a passport recognition skill because it introduces mutable configuration and administrative operations unrelated to the stated extraction task. In agent environments, such hidden breadth raises the risk of policy bypass, unintended reconfiguration, or expansion into unsanctioned processing flows.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The README presents this skill as a front-end to a broad, general-purpose ADP CLI with document parsing, arbitrary extraction, task management, and custom app administration, while the manifest claims a zero-config China-passport-only extractor. That scope mismatch can mislead an agent into invoking capabilities far beyond the declared purpose, increasing the chance of unintended data access, document processing, or administrative actions.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: Documenting `custom-app create`, `update`, `delete`, and related management operations exposes administrative capabilities unrelated to passport field extraction. In an agent context, this can expand the effective permission surface from passive extraction to mutation of backend application configuration, which could be abused or triggered accidentally.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Application management is explicitly advertised even though the skill is described as a passport-recognition utility. That unjustified administrative surface makes the skill more dangerous in context because users and agents may trust it as a narrow document-extraction tool while it actually enables broader control-plane actions.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README instructs users to configure API keys and process remote content but does not clearly disclose that document contents may be transmitted to a cloud service. For passport-processing workflows, this omission is significant because users may handle highly sensitive PII without understanding storage, transfer, residency, or third-party processing implications.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation instructions recommend piping remote content directly into `bash` and `iex` without any integrity verification, pinning, or warning. If the remote source, network path, or repository is compromised, users or agents could execute arbitrary code during installation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs users to upload passport images and extract highly sensitive identity data through a remote third-party service, but it does not prominently warn about privacy, consent, data residency, retention, or regulatory obligations. Because passports contain high-value PII, users may unknowingly transmit regulated identity documents to an external processor without adequate safeguards or informed consent.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The installation section includes commands that fetch remote scripts and execute them directly via bash/PowerShell without verification guidance. This is dangerous because any compromise of the source, repository, network path, or script contents could lead to immediate arbitrary code execution on the user's machine.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.