护照识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill appears legitimate for passport extraction, but its install and data-handling instructions create review-worthy supply-chain, credential, and sensitive-document risks.

Install only after reviewing the CLI source and using a pinned, verifiable package or signed release; avoid curl-to-shell and irm-to-iex commands. Do not paste real API keys into chats or logged shell commands, restrict processing to intended passport files, and confirm Laiye ADP privacy, retention, deletion, jurisdiction, and authorization terms before uploading passport images.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63
• Finding: Mutable Remote Installation Scripts Executed Directly by a Shell## Vulnerability Details **File Locations**: - `SKILL.md:63` - `SKILL.md:68` - `README.md:30` - `README.md:35` - `README-CN.md:29` - `README-CN.md:34` **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical **Vulnerable Code**: ```bash # Shell installer curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash ``` ```powershell # PowerShell installer irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex ``` ### Technical Analysis These installation commands retrieve scripts from the mutable `main` branch of an external GitHub repository and pass the responses directly to `bash` or PowerShell's `Invoke-Expression`. The downloaded content is not displayed for review, pinned to an immutable commit, checked against a cryptographic digest, or authenticated with a vendor signature. Although the repository name is consistent with the advertised vendor, this project contains neither the installer source nor a checksum or signature that would allow the reviewed artifact to establish what code will run. The effective payload can therefore change after this Skill has been audited. The commands also create a time-of-check/time-of-use trust problem: even if the remote script is benign at one point, compromise of the repository, publisher account, release process, or another relevant delivery component could cause subsequent installations to execute attacker-controlled code. `curl -f` and HTTPS protect against some transport failures but do not establish artifact immutability or publisher-controlled code signing. Direct shell execution exceeds the minimum privilege necessary for the declared document-extraction functionality. Installing a CLI may be necessary, but executing an unverified mutable response is not. The script inherits all privileges and environmental access of the user who launches it; if invoked with elevated privileges, the payload receives t ...[truncated 1539 chars]
• Remediation: ## Remediation Suggestions 1. Remove all direct `curl | bash` and `irm | iex` installation instructions. 2. Publish versioned installation artifacts through immutable releases rather than a mutable branch. 3. Instruct users to download the installer to disk without executing it: ```bash curl -fL -o adp-init.sh https://example.invalid/releases/download/vX.Y.Z/adp-init.sh ``` 4. Publish a SHA-256 digest over a separate authenticated channel and require verification before execution: ```bash echo '<expected-sha256> adp-init.sh' | sha256sum --check - ``` 5. Sign release artifacts with a documented vendor signing key and require signature verification. A checksum hosted beside a compromised artifact is insufficient by itself. 6. Pin documentation to a specific release version or immutable commit rather than `main`. 7. Advise users to inspect the downloaded script and execute it explicitly only after verification. 8. Ensure the installer does not require administrator privileges unless a specific installation step genuinely needs them. Prefer installation into a user-owned directory. 9. Apply equivalent download, signature, and version-pinning controls to the PowerShell installer. 10. Document all filesystem changes, network requests, and executable locations used by the installer.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57
• Finding: Unpinned CLI Package Installed Globally from npm## Vulnerability Details **File Locations**: - `SKILL.md:57` - `README.md:24` - `README-CN.md:23` **Vulnerability Type**: Unpinned global third-party dependency installation **Risk Level**: Medium **Vulnerable Code**: ```bash npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli ``` ### Technical Analysis The installation command does not specify an audited package version. It therefore resolves whatever version is current at installation time, allowing the effective dependency content to change after this Skill is reviewed. npm packages can contain executable lifecycle scripts and installed command-line programs. A compromised package publisher, registry account, or future release could consequently cause attacker-controlled code to run during installation or when the `adp` command is later invoked. The `-g` option installs the package globally. This provides broader persistence and command visibility than a project-local or isolated installation and may require elevated permissions on some systems. Global installation is not strictly necessary for invoking a document-processing client and therefore exceeds the minimum practical installation scope. ### Attack Path 1. An attacker compromises the npm package publisher, publishing token, or release workflow. 2. The attacker publishes a malicious package version under the legitimate package name. 3. A user follows the unpinned installation command. 4. npm resolves the newly published malicious version. 5. Package lifecycle code may execute during installation, or malicious CLI code executes when the user later invokes `adp`. 6. Because the package is installed globally, the altered command remains available across projects and future sessions. ### Impact Assessment The dependency can execute with the permissions of the npm process. Potential consequences include: - Arbitrary code execution during installation or CLI use. - Theft of user files, environment variables, API keys, and npm credentials. ...[truncated 393 chars]
• Remediation: ## Remediation Suggestions 1. Pin the CLI to a specific reviewed version: ```bash npm install --global @laiye-adp/agentic-doc-parse-and-extract-cli@X.Y.Z ``` 2. Publish the expected package integrity digest and document how users can verify package provenance. 3. Use npm provenance or an equivalent signed publishing mechanism. 4. Prefer a user-scoped, project-local, or isolated installation over a global installation. 5. Avoid `sudo npm install -g`; document a user-owned npm prefix if global command availability is required. 6. Review package lifecycle scripts and use `--ignore-scripts` where installation does not require them. 7. Establish automated dependency monitoring and require security review before changing the pinned version. 8. Keep a lockfile or equivalent immutable dependency manifest where the installation model supports one.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91
• Finding: API Key Exposed Through Command-Line Arguments## Vulnerability Details **File Locations**: - `SKILL.md:91` - `README.md:51` - `README-CN.md:57` **Vulnerability Type**: Sensitive credential passed as a command-line argument **Risk Level**: Medium **Vulnerable Code**: ```bash adp config set --api-key <your-api-key> adp config set --api-base-url https://adp.laiye.com ``` The English README provides the equivalent configuration workflow using the global service endpoint: ```bash adp config set --api-key <your-api-key> adp config set --api-base-url https://adp-global.laiye.com adp config get ``` ### Technical Analysis The instructions direct users to place an API key directly in a shell command. Depending on the operating system and shell configuration, the secret may be retained in shell history, terminal capture, audit logs, AI Agent transcripts, command telemetry, or process argument listings. The documentation later recommends environment-variable storage, but environment variables can also leak through process environments, debug output, crash reports, or improperly configured CI logs. Neither approach should be treated as secure unless accompanied by explicit secret-handling controls. The project states that the CLI stores an encrypted key in `~/.adp/key.enc`, but the CLI implementation and key-management behavior are not included in this artifact and could not be verified. Encryption at rest also does not prevent initial disclosure through the command line. ### Attack Path 1. A user substitutes a real ADP API key into the documented command. 2. The shell records the complete command in its history, or an Agent/terminal system records it in execution logs. 3. Another local user, support operator, log collector, compromised process, or party with access to the transcript retrieves the command. 4. The attacker extracts the API key and authenticates to the ADP service. 5. The key is used to consume paid credits or access resources permitted to that account until it is revoked. ### Impa ...[truncated 655 chars]
• Remediation: ## Remediation Suggestions 1. Replace command-line secret entry with a hidden interactive prompt that does not echo or retain the key. 2. Support reading the key from standard input or a protected secret manager without placing it in process arguments. 3. Explicitly warn users not to paste API keys into AI chats, Agent prompts, shell history, issue reports, or logs. 4. If shell entry is unavoidable, document shell-specific methods to suppress history and explain their limitations. 5. Store credentials with restrictive filesystem permissions and use operating-system credential storage where available. 6. Redact API keys from normal, debug, and error output, including the output of `adp config get`. 7. Add key rotation and revocation guidance for suspected exposure. 8. In CI environments, use masked secret variables and prevent command tracing such as `set -x` while credentials are handled. 9. Verify and document the threat model and key-management design behind `~/.adp/key.enc`, including how its encryption key is protected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The README describes a broad, general-purpose ADP document parsing and extraction CLI rather than a narrowly scoped China-passport recognition skill. This scope mismatch is dangerous because agents or users may grant the skill broader trust and permissions than intended, enabling processing of arbitrary documents and workflows outside the manifest-declared purpose.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 97% confidence
• Finding: The '| bash' pattern causes unreviewed remote content to execute immediately, which is a classic arbitrary code execution vector. In the context of a skill README, this is especially dangerous because users or automation may copy the command verbatim, giving any compromised upstream script full execution on the host.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The documented commands include generic local parsing, remote URL handling, and base64 processing that materially exceed the manifest's stated passport-recognition function. In an agent setting, this can expand the attack surface to arbitrary file ingestion and external content retrieval, creating opportunities for data exfiltration, unauthorized processing, or misuse of the skill as a general document-processing tool.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: Exposing custom application creation, update, deletion, and AI-generated schema capabilities gives the skill mutable behavior far beyond a fixed passport extraction workflow. This is risky because an agent or user could repurpose the skill into arbitrary extraction pipelines, bypassing the narrow trust assumptions implied by the manifest and increasing the chance of unauthorized data handling.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The README presents this skill as a general-purpose ADP document parsing and extraction interface with broad document coverage and autonomous agent usage, which materially exceeds the manifest’s stated passport-only, zero-configuration purpose. In an agent ecosystem, this scope mismatch is dangerous because it can cause a caller to grant broader file access, invoke unintended capabilities, or process arbitrary sensitive documents under the guise of a narrowly scoped identity-extraction skill.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 97% confidence
• Finding: Piping a network response directly into bash removes any opportunity for inspection and turns a remote content fetch into immediate code execution. In an agent skill context, this is especially risky because automated systems may repeat or recommend the pattern at scale, magnifying the impact of a repository compromise or man-in-the-middle/content substitution event.

Description-Behavior Mismatch

High

• Confidence: 96% confidence
• Finding: Documenting custom application creation, update, and deletion introduces privileged lifecycle-management capabilities unrelated to passport field extraction. For a narrowly scoped skill, this broadens the operational surface and could let an agent alter extraction apps, delete configurations, or pivot into administrative actions that are unexpected by users and orchestration systems.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: The skill instructs users to upload passport images and extract highly sensitive identity data through a third-party remote ADP service, but it does not provide clear privacy, consent, retention, jurisdiction, or data-handling warnings. Because passports contain government-issued identifiers and personal details, omission of explicit safeguards can lead to privacy violations, regulatory exposure, or inappropriate transmission of sensitive data to external infrastructure.

Chaining Abuse

High

• Category: Tool Misuse

Content

```bash
# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 99% confidence
• Finding: The use of a network fetch chained directly into bash removes any opportunity for review or validation and turns remote content into immediate code execution. In skill context, this is more dangerous because the document is framed as a turnkey setup guide, increasing the chance that users will copy-paste the command verbatim and compromise their environment if the fetched content is malicious or altered.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README recommends piping remotely fetched shell and PowerShell scripts directly into an interpreter without verification steps or security warnings. This is dangerous because compromise of the upstream source, transport, or repository content could lead to immediate arbitrary code execution on the host system.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: Application management and lifecycle control are not justified by the declared passport-recognition task and indicate avoidable over-privilege. In this context, unnecessary management capabilities increase the chance of misuse, accidental destructive actions, or unauthorized reconfiguration of extraction behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README recommends remote installation via shell and PowerShell one-liners without any warning about code-execution risk, provenance verification, or integrity checking. This is dangerous because users may execute fetched code directly from the network, allowing supply-chain compromise or malicious script substitution to result in immediate arbitrary code execution on the host.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation section recommends executing remote shell and PowerShell bootstrap scripts directly from the network without any integrity verification or safety warning. This creates a supply-chain risk: if the upstream repository, network path, or hosted script is compromised, users may execute arbitrary code on their machines immediately.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 93% confidence
• Finding: The command fetches an external script from GitHub at runtime, introducing a supply-chain trust dependency into installation. While external fetching alone is common, in this context it becomes dangerous because the fetched content is immediately treated as executable setup logic for the local machine.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 90% confidence
• Finding: The command fetches a remote script from GitHub and executes installation logic originating outside the local trust boundary. Even if common in developer tooling, it creates a supply-chain risk: compromise of the repository, distribution path, or referenced script content can lead to arbitrary code execution on the user’s system.

External Script Fetching

Low

• Category: Supply Chain

Content

```bash
# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash
```

```bash

• Confidence: 98% confidence
• Finding: This command fetches a script from a remote GitHub URL and executes it locally, which is a classic external-script execution pattern. Even if the source is legitimate today, compromise of the repository, DNS/TLS interception edge cases, or script changes over time could result in arbitrary command execution on the user's system.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: The document specifies that the agreement is governed by the laws of the People's Republic of China and disputes must be submitted to the competent court where the Licensor is registered. This is a natural-language policy constraint affecting locale/jurisdiction without presenting any user choice or alternative, which matches the policy-violation category's concern about fixed locale constraints unless clearly justified as region-specific.

Static analysis

No suspicious patterns detected.