护照识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill appears legitimate for passport extraction, but its install and data-handling instructions create review-worthy supply-chain, credential, and sensitive-document risks.

Install only after reviewing the CLI source and using a pinned, verifiable package or signed release; avoid curl-to-shell and irm-to-iex commands. Do not paste real API keys into chats or logged shell commands, restrict processing to intended passport files, and confirm Laiye ADP privacy, retention, deletion, jurisdiction, and authorization terms before uploading passport images.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Mutable Remote Installation Scripts Executed Directly by a Shell

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:63
• SKILL.md:68
• README.md:30
• README.md:35
• README-CN.md:29
• README-CN.md:34

Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash

# Shell installer
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

powershell

# PowerShell installer
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Technical Analysis

These installation commands retrieve scripts from the mutable main branch of an external GitHub repository and pass the responses directly to bash or PowerShell's Invoke-Expression. The downloaded content is not displayed for review, pinned to an immutable commit, checked against a cryptographic digest, or authenticated with a vendor signature.

Although the repository name is consistent with the advertised vendor, this project contains neither the installer source nor a checksum or signature that would allow the reviewed artifact to establish what code will run. The effective payload can therefore change after this Skill has been audited.

The commands also create a time-of-check/time-of-use trust problem: even if the remote script is benign at one point, compromise of the repository, publisher account, release process, or another relevant delivery component could cause subsequent installations to execute attacker-controlled code. curl -f and HTTPS protect against some transport failures but do not establish artifact immutability or publisher-controlled code signing.

Direct shell execution exceeds the minimum privilege necessary for the declared document-extraction functionality. Installing a CLI may be necessary, but executing an unverified mutable response is not. The script inherits all privileges and environmental access of the user who launches it; if invoked with elevated privileges, the payload receives t ...[truncated 1539 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all direct curl | bash and irm | iex installation instructions.
2. Publish versioned installation artifacts through immutable releases rather than a mutable branch.
3. Instruct users to download the installer to disk without executing it:

bash

curl -fL -o adp-init.sh https://example.invalid/releases/download/vX.Y.Z/adp-init.sh

4. Publish a SHA-256 digest over a separate authenticated channel and require verification before execution:

bash

echo '<expected-sha256>  adp-init.sh' | sha256sum --check -

5. Sign release artifacts with a documented vendor signing key and require signature verification. A checksum hosted beside a compromised artifact is insufficient by itself.
6. Pin documentation to a specific release version or immutable commit rather than main.
7. Advise users to inspect the downloaded script and execute it explicitly only after verification.
8. Ensure the installer does not require administrator privileges unless a specific installation step genuinely needs them. Prefer installation into a user-owned directory.
9. Apply equivalent download, signature, and version-pinning controls to the PowerShell installer.
10. Document all filesystem changes, network requests, and executable locations used by the installer.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:57

Finding

Unpinned CLI Package Installed Globally from npm

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:57
• README.md:24
• README-CN.md:23

Vulnerability Type: Unpinned global third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

Technical Analysis

The installation command does not specify an audited package version. It therefore resolves whatever version is current at installation time, allowing the effective dependency content to change after this Skill is reviewed.

npm packages can contain executable lifecycle scripts and installed command-line programs. A compromised package publisher, registry account, or future release could consequently cause attacker-controlled code to run during installation or when the adp command is later invoked.

The -g option installs the package globally. This provides broader persistence and command visibility than a project-local or isolated installation and may require elevated permissions on some systems. Global installation is not strictly necessary for invoking a document-processing client and therefore exceeds the minimum practical installation scope.

Attack Path

1. An attacker compromises the npm package publisher, publishing token, or release workflow.
2. The attacker publishes a malicious package version under the legitimate package name.
3. A user follows the unpinned installation command.
4. npm resolves the newly published malicious version.
5. Package lifecycle code may execute during installation, or malicious CLI code executes when the user later invokes adp.
6. Because the package is installed globally, the altered command remains available across projects and future sessions.

Impact Assessment

The dependency can execute with the permissions of the npm process. Potential consequences include:

• Arbitrary code execution during installation or CLI use.
• Theft of user files, environment variables, API keys, and npm credentials.

...[truncated 393 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to a specific reviewed version:

bash

npm install --global @laiye-adp/agentic-doc-parse-and-extract-cli@X.Y.Z

2. Publish the expected package integrity digest and document how users can verify package provenance.
3. Use npm provenance or an equivalent signed publishing mechanism.
4. Prefer a user-scoped, project-local, or isolated installation over a global installation.
5. Avoid sudo npm install -g; document a user-owned npm prefix if global command availability is required.
6. Review package lifecycle scripts and use --ignore-scripts where installation does not require them.
7. Establish automated dependency monitoring and require security review before changing the pinned version.
8. Keep a lockfile or equivalent immutable dependency manifest where the installation model supports one.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:91

Finding

API Key Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:91
• README.md:51
• README-CN.md:57

Vulnerability Type: Sensitive credential passed as a command-line argument
Risk Level: Medium

Vulnerable Code:

bash

adp config set --api-key <your-api-key>
adp config set --api-base-url https://adp.laiye.com

The English README provides the equivalent configuration workflow using the global service endpoint:

bash

adp config set --api-key <your-api-key>
adp config set --api-base-url https://adp-global.laiye.com
adp config get

Technical Analysis

The instructions direct users to place an API key directly in a shell command. Depending on the operating system and shell configuration, the secret may be retained in shell history, terminal capture, audit logs, AI Agent transcripts, command telemetry, or process argument listings.

The documentation later recommends environment-variable storage, but environment variables can also leak through process environments, debug output, crash reports, or improperly configured CI logs. Neither approach should be treated as secure unless accompanied by explicit secret-handling controls.

The project states that the CLI stores an encrypted key in ~/.adp/key.enc, but the CLI implementation and key-management behavior are not included in this artifact and could not be verified. Encryption at rest also does not prevent initial disclosure through the command line.

Attack Path

1. A user substitutes a real ADP API key into the documented command.
2. The shell records the complete command in its history, or an Agent/terminal system records it in execution logs.
3. Another local user, support operator, log collector, compromised process, or party with access to the transcript retrieves the command.
4. The attacker extracts the API key and authenticates to the ADP service.
5. The key is used to consume paid credits or access resources permitted to that account until it is revoked.

Impa

...[truncated 655 chars]

Remediation

View remediation

Remediation Suggestions

1. Replace command-line secret entry with a hidden interactive prompt that does not echo or retain the key.
2. Support reading the key from standard input or a protected secret manager without placing it in process arguments.
3. Explicitly warn users not to paste API keys into AI chats, Agent prompts, shell history, issue reports, or logs.
4. If shell entry is unavoidable, document shell-specific methods to suppress history and explain their limitations.
5. Store credentials with restrictive filesystem permissions and use operating-system credential storage where available.
6. Redact API keys from normal, debug, and error output, including the output of adp config get.
7. Add key rotation and revocation guidance for suspected exposure.
8. In CI environments, use masked secret variables and prevent command tracing such as set -x while credentials are handled.
9. Verify and document the threat model and key-management design behind ~/.adp/key.enc, including how its encryption key is protected.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (21)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a broad, general-purpose ADP document parsing and extraction CLI rather than a narrowly scoped China-passport recognition skill. This scope mismatch is dangerous because agents or users may grant the skill broader trust and permissions than intended, enabling processing of arbitrary documents and workflows outside the manifest-declared purpose.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

The '| bash' pattern causes unreviewed remote content to execute immediately, which is a classic arbitrary code execution vector. In the context of a skill README, this is especially dangerous because users or automation may copy the command verbatim, giving any compromised upstream script full execution on the host.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documented commands include generic local parsing, remote URL handling, and base64 processing that materially exceed the manifest's stated passport-recognition function. In an agent setting, this can expand the attack surface to arbitrary file ingestion and external content retrieval, creating opportunities for data exfiltration, unauthorized processing, or misuse of the skill as a general document-processing tool.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Exposing custom application creation, update, deletion, and AI-generated schema capabilities gives the skill mutable behavior far beyond a fixed passport extraction workflow. This is risky because an agent or user could repurpose the skill into arbitrary extraction pipelines, bypassing the narrow trust assumptions implied by the manifest and increasing the chance of unauthorized data handling.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README presents this skill as a general-purpose ADP document parsing and extraction interface with broad document coverage and autonomous agent usage, which materially exceeds the manifest’s stated passport-only, zero-configuration purpose. In an agent ecosystem, this scope mismatch is dangerous because it can cause a caller to grant broader file access, invoke unintended capabilities, or process arbitrary sensitive documents under the guise of a narrowly scoped identity-extraction skill.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping a network response directly into bash removes any opportunity for inspection and turns a remote content fetch into immediate code execution. In an agent skill context, this is especially risky because automated systems may repeat or recommend the pattern at scale, magnifying the impact of a repository compromise or man-in-the-middle/content substitution event.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Documenting custom application creation, update, and deletion introduces privileged lifecycle-management capabilities unrelated to passport field extraction. For a narrowly scoped skill, this broadens the operational surface and could let an agent alter extraction apps, delete configurations, or pivot into administrative actions that are unexpected by users and orchestration systems.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs users to upload passport images and extract highly sensitive identity data through a third-party remote ADP service, but it does not provide clear privacy, consent, retention, jurisdiction, or data-handling warnings. Because passports contain government-issued identifiers and personal details, omission of explicit safeguards can lead to privacy violations, regulatory exposure, or inappropriate transmission of sensitive data to external infrastructure.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of a network fetch chained directly into bash removes any opportunity for review or validation and turns remote content into immediate code execution. In skill context, this is more dangerous because the document is framed as a turnkey setup guide, increasing the chance that users will copy-paste the command verbatim and compromise their environment if the fetched content is malicious or altered.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README recommends piping remotely fetched shell and PowerShell scripts directly into an interpreter without verification steps or security warnings. This is dangerous because compromise of the upstream source, transport, or repository content could lead to immediate arbitrary code execution on the host system.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Application management and lifecycle control are not justified by the declared passport-recognition task and indicate avoidable over-privilege. In this context, unnecessary management capabilities increase the chance of misuse, accidental destructive actions, or unauthorized reconfiguration of extraction behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README recommends remote installation via shell and PowerShell one-liners without any warning about code-execution risk, provenance verification, or integrity checking. This is dangerous because users may execute fetched code directly from the network, allowing supply-chain compromise or malicious script substitution to result in immediate arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation section recommends executing remote shell and PowerShell bootstrap scripts directly from the network without any integrity verification or safety warning. This creates a supply-chain risk: if the upstream repository, network path, or hosted script is compromised, users may execute arbitrary code on their machines immediately.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 93% confidence

Finding

The command fetches an external script from GitHub at runtime, introducing a supply-chain trust dependency into installation. While external fetching alone is common, in this context it becomes dangerous because the fetched content is immediately treated as executable setup logic for the local machine.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The command fetches a remote script from GitHub and executes installation logic originating outside the local trust boundary. Even if common in developer tooling, it creates a supply-chain risk: compromise of the repository, distribution path, or referenced script content can lead to arbitrary code execution on the user’s system.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

This command fetches a script from a remote GitHub URL and executes it locally, which is a classic external-script execution pattern. Even if the source is legitimate today, compromise of the repository, DNS/TLS interception edge cases, or script changes over time could result in arbitrary command execution on the user's system.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The document specifies that the agreement is governed by the laws of the People's Republic of China and disputes must be submitted to the competent court where the Licensor is registered. This is a natural-language policy constraint affecting locale/jurisdiction without presenting any user choice or alternative, which matches the policy-violation category's concern about fixed locale constraints unless clearly justified as region-specific.

Content

No source excerpt is available for this finding.