PDF to Structured JSON（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:23 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent cloud document-parsing integration, but its install instructions include unsafe remote script execution and unpinned global CLI installation.

Review before installing. Prefer a pinned package or signed release, avoid running the documented curl | bash or irm | iex commands, and do not let an agent install or update the CLI without explicit approval. Only submit documents you are comfortable sending to Laiye ADP's cloud service, especially for invoices, IDs, contracts, or regulated data.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:79

Finding

Mutable Remote Installation Scripts Are Executed Without Verification

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:79-85
• README.md:29-35
• README-CN.md:28-34

Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Vulnerable Code:

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

# Method 3: PowerShell script (Windows, when npm is not available)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

The Chinese README contains the equivalent commands:

bash

# Method 2: Shell script
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

powershell

# Method 3: PowerShell script
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Technical Analysis

These commands retrieve scripts from an external GitHub repository and send the responses directly to command interpreters. Neither installation path saves the script for inspection nor verifies a checksum, cryptographic signature, expected content digest, or publisher provenance before execution.

The URLs refer to the mutable main branch. Consequently, the effective code executed by users can change after this Skill has been reviewed. A compromise of the upstream repository, maintainer account, release process, or another relevant delivery component could replace the installer with arbitrary commands.

The repository namespace and product branding are internally consistent, but that does not make direct execution of an unverified, mutable response safe. The remote installer implementations are not included in the audited project, so their behavior cannot be validated from this artifact.

Installation of an ADP client is necessary for the declared document-parsing workflow. However, pipe-to-shell executio ...[truncated 1616 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the curl | bash and irm | iex installation instructions from all three documentation files.
2. Pin installation artifacts to an immutable release version, commit identifier, or content digest rather than the mutable main branch.
3. Publish SHA-256 checksums and cryptographic signatures through an independently secured channel.
4. Require users to download the artifact first, verify its checksum and signature, inspect it where appropriate, and only then execute it.
5. Prefer a version-pinned package-manager installation or a signed release artifact from the official release page.
6. Do not allow an AI agent to install external executable code automatically. Require explicit user approval for installation and display the exact version and source.
7. Run installation with ordinary user privileges unless a documented operation strictly requires elevation.
8. Keep the English, Chinese, and Skill instructions synchronized so an unsafe fallback does not remain in one documentation variant.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:74

Finding

Unpinned npm Package Is Installed Globally

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:74-75
• README.md:24-25
• README-CN.md:23-24

Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code:

bash

# Method 1: npm (Recommended, cross-platform)
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

The Chinese README contains the equivalent command:

bash

# Method 1: npm
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

Technical Analysis

The command installs whichever package version the npm registry currently resolves as the default. It does not pin an audited version, provide an integrity digest, use a lockfile, or require provenance verification.

npm packages may define lifecycle scripts that execute during installation. Therefore, compromise of the package publisher account, registry release process, or a future package version could lead to installation-time code execution. Global installation also places the resulting executable into the user's general command environment rather than limiting it to a specific project or isolated runtime.

The package name is consistently associated with the declared vendor and no evidence of dependency confusion or typosquatting was found in the artifact. The issue is the unsafe, mutable installation policy rather than proof that the current package is malicious.

Attack Path

1. An attacker compromises the npm publishing account or package release process, or an unsafe future version is published.
2. The compromised version becomes the package's default version.
3. A user or AI agent executes the documented unpinned global installation command.
4. npm downloads the compromised release.
5. Any defined installation lifecycle script executes with the invoking user's permissions.
6. The globally installed adp executable is subsequently trusted and invoked for API-key configuration and document processin ...[truncated 879 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the package to a reviewed version, for example by documenting an exact version rather than relying on the registry default.
2. Verify npm publisher provenance and package integrity before installation.
3. Record and validate the expected package digest in a controlled installation process.
4. Prefer a project-local or isolated installation instead of a global installation where operationally feasible.
5. Review required npm lifecycle scripts. Disable lifecycle scripts during installation when they are not necessary.
6. Require explicit user confirmation before an AI agent installs or upgrades the dependency.
7. Establish a controlled update process that reviews each new version before changing the documented pin.
8. Avoid running npm as root or administrator.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The '| bash' construct is especially dangerous because it removes any inspection step and immediately executes whatever bytes are returned by the remote server. In a skill context, users may copy-paste installation instructions verbatim, increasing the likelihood of supply-chain compromise, account takeover, or host compromise if the fetched script is tampered with.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The curl ... | bash pattern is especially dangerous in an agent context because it turns a documentation example into immediate arbitrary code execution from network content. If copied by an automated system or a user following the README, any compromise of the remote script source can result in full host compromise, credential theft, or persistence.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The command chains network retrieval directly into shell execution using '| bash', which is a classic unsafe pattern enabling arbitrary command execution from remote content. In this skill context, users are being guided to run the command as part of setup, increasing the likelihood of exploitation if the remote source is tampered with or replaced.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README recommends installing via commands that fetch and immediately execute remote scripts, but it does not warn users about the trust and supply-chain risks of doing so. If the upstream repository, network path, or referenced script is compromised, users may execute arbitrary code on their systems during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README encourages processing local and remote documents and exporting task/result artifacts, but it does not clearly warn that document contents are sent to a public cloud service and that outputs and task IDs may be written to disk. For sensitive documents, this omission can lead to unintentional data disclosure, retention, and compliance violations because users or agents may treat the skill as local-only parsing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README exposes mutation-capable commands such as custom-app create, update, and delete that go beyond a narrow document-parsing skill and materially expand what an agent could do if it follows the advertised command set. In an agent-skill context, this increases the risk of unintended state changes, destructive operations, or privilege misuse against the user's ADP account or applications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly directs users to submit local files, remote URLs, and Base64 document contents to a third-party ADP cloud service, but it does not prominently warn that document contents may leave the local environment and be processed externally. In a document-parsing skill, this matters because users may provide invoices, IDs, contracts, or other sensitive files, creating privacy, compliance, and data-governance risk if they are transmitted without informed consent.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command uses curl to retrieve a script from a remote URL and passes it directly to the shell. This creates a direct remote-code-execution path during installation, so any compromise of the source, redirect path, or delivered content can result in arbitrary command execution on the user's machine.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The installation instruction fetches a remote script and executes it directly, which creates a supply-chain and integrity risk if the hosted script, transport, repository, or publisher account is compromised. Users and agents have no opportunity to inspect or pin the exact code before execution.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

Documenting account configuration, cached app access, and credit-management operations broadens the operational scope beyond simple PDF-to-JSON conversion. While not inherently malicious, these commands let an agent inspect account state or alter runtime configuration, which is unnecessary for the stated purpose and increases attack surface if misused.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The skill recommends installing software by fetching a remote script from GitHub and piping it directly into bash. This is dangerous because any compromise of the upstream repository, delivery path, or referenced script would result in immediate arbitrary code execution on the user's machine without prior inspection.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination