Global Purchase Order Recognition and Extraction（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:48 AM UTC
• Version: 1.0.1

Overview

This appears to be a real cloud purchase-order extraction skill, but its installation guidance and broad CLI documentation create review-worthy supply-chain, scope, and data-handling risks.

Review before installing. Avoid the curl|bash or irm|iex paths, prefer a pinned and verified release, do not run installers with elevated privileges, and confirm your organization permits purchase orders, invoices, IDs, or other sensitive documents to be sent to Laiye ADP cloud. Use a scoped API key and constrain agents to the order-extraction commands only.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:61

Finding

Execution of Mutable Remote Installation Scripts Without Integrity Verification

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:61-69, README.md:28-36, README-CN.md:27-35
Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: Critical

Complete Code Snippet

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

powershell

# Method 3: PowerShell script (Windows, when npm is not available)
irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Equivalent commands appear in all three documentation files:

• SKILL.md:61-69
• README.md:28-36
• README-CN.md:27-35

Technical Analysis

The installation instructions download shell or PowerShell code from the mutable main branch of an external GitHub repository and pass it directly to an interpreter. The downloaded content is not pinned to an immutable commit or release and is not checked against a cryptographic digest or publisher signature.

Consequently, the effective code executed by users can change after this Skill has been reviewed. Compromise of the upstream repository, its maintainer credentials, the release workflow, or another authorized publishing account could cause arbitrary replacement code to be delivered through these commands.

The GitHub organization and repository names are consistent with the vendor identified by the Skill, but that association does not mitigate the absence of immutable versioning and integrity verification. The actual remote scripts were not included in the audited project and therefore their current behavior could not be verified.

Direct pipe-to-interpreter execution is not necessary for the declared purchase-order extraction functionality. Installation can instead use a pinned, verified artifact. This behavior therefore exceeds the minimum execution trust required to install and operate the CLI.

...[truncated 1408 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all curl | bash and irm | iex installation instructions.
2. Pin installation artifacts to a specific audited version and immutable release or commit.
3. Download the artifact to a local file without executing it:

   bash

   curl -fL -o adp-init.sh https://example.invalid/releases/vX.Y.Z/adp-init.sh
   

4. Publish the expected SHA-256 digest through a separately protected release channel and verify it before execution:

   bash

   echo "<EXPECTED_SHA256>  adp-init.sh" | sha256sum --check -
   

5. Prefer cryptographically signed release artifacts and verify the signature against a documented publisher key.
6. Allow the user to inspect the downloaded script before explicitly approving execution.
7. State that installation must be performed without administrator or root privileges unless a documented operation strictly requires elevation.
8. Apply the corrected instructions consistently to SKILL.md, README.md, and README-CN.md.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:55

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:55-58, README.md:22-25, README-CN.md:21-24
Vulnerability Type: Unpinned third-party dependency with installation-time execution risk
Risk Level: Medium

Complete Code Snippet

bash

# Method 1: npm (recommended, cross-platform)
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

Equivalent commands appear in:

• SKILL.md:55-58
• README.md:22-25
• README-CN.md:21-24

Technical Analysis

The installation command does not specify an exact package version. npm will therefore resolve the package version associated with the current default distribution tag at installation time. The reviewed Skill cannot guarantee that this future package content will be identical to the version originally assessed.

npm packages may define lifecycle scripts that execute during installation. Because the command does not disable such scripts or verify a known artifact digest, a compromised publisher account or malicious future release could execute code during installation.

The -g option also installs the CLI globally. Depending on the local npm configuration, this can write to user-wide or system-wide package and executable directories. Global installation is not essential to the document-extraction functionality; a pinned project-local installation or verified standalone release would provide a narrower modification scope.

No evidence was found that the named package is currently malicious. The finding concerns the unbounded trust placed in future package versions and the unsafe installation model.

Attack Path

1. An attacker compromises the npm publisher account, publishing token, or package release workflow.
2. The attacker publishes a malicious package version and assigns it to the default npm distribution tag.
3. A user or AI agent runs the documented unversioned installation command.
4. npm resolves and downloads the malicious versio ...[truncated 1063 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the dependency to an exact audited version:

   bash

   npm install --global @laiye-adp/agentic-doc-parse-and-extract-cli@X.Y.Z
   

2. Document the expected npm integrity value or provide signed release provenance so consumers can verify the package.
3. Prefer a project-local or isolated installation rather than -g where global command availability is not required.
4. Determine whether npm lifecycle scripts are required. If they are unnecessary, install with:

   bash

   npm install --ignore-scripts --save-exact @laiye-adp/agentic-doc-parse-and-extract-cli@X.Y.Z
   

5. If lifecycle scripts are required, document their purpose and audit their exact pinned implementation before installation.
6. Advise users not to run npm as root or from an elevated administrator shell.
7. Use automated dependency monitoring and require protected, reviewed release workflows with multi-factor authentication and short-lived publishing credentials.
8. Keep the pinned version and verification instructions synchronized across all three documentation files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (23)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a general-purpose cloud document parsing/extraction CLI covering invoices, IDs, receipts, generic documents, autonomous planning, and tool use, which materially exceeds the skill manifest's narrow claim of purchase-order-only extraction. This capability mismatch is dangerous because an agent or user may grant broader document access or invoke unintended functionality under the assumption that the skill is limited to PO extraction.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The shell pipeline chains downloaded content directly into bash, eliminating an inspection boundary and making arbitrary command execution trivial if the upstream content is modified. This is especially dangerous in a skill README because it normalizes unsafe operator behavior and encourages blind execution of network-delivered code.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 97% confidence

Finding

Piping a remotely fetched script directly into bash creates a one-step arbitrary code execution path with no opportunity for inspection, integrity verification, or user review. In the context of an AI skill, this is more dangerous because automated systems or users may copy the command verbatim, enabling supply-chain compromise to execute immediately on endpoints.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The pipe to bash is the dangerous execution sink: it converts downloaded content directly into code execution, eliminating any opportunity for review or validation. In a skill intended for broad operational use, this sharply increases supply-chain risk because users may follow the command verbatim in production or administrator environments.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README promotes processing local files, remote URLs, and Base64 content via a public cloud service but does not clearly warn that potentially sensitive documents will be transmitted off-host for remote processing. In a document-extraction skill, this omission is materially risky because users may upload invoices, purchase orders, IDs, or other confidential business records without understanding the privacy and compliance implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The installation instructions recommend piping remotely fetched shell and PowerShell scripts directly into an interpreter without any integrity verification, pinning, or warning. This is dangerous because compromise of the hosting source, repository, network path, or referenced script can lead to immediate arbitrary code execution on the user's machine.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The documented commands expose generic local parsing, remote URL fetching, Base64 ingestion, async task handling, and broad extraction workflows beyond the stated PO field extraction purpose. In skill context, this increases the attack surface by enabling arbitrary document processing and remote content handling that a caller would not reasonably expect from a narrowly described procurement extractor.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Application lifecycle management commands such as create, update, delete, and AI-generate are administrative capabilities unrelated to simply extracting fields from purchase orders. In this skill context, exposing app-management functions violates least privilege and could let an agent alter extraction configurations, delete versions, or manipulate broader tenant resources.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README presents a broad, general-purpose document-processing CLI with capabilities far beyond the manifest's narrowly claimed purchase/sales order extraction skill. This scope mismatch is dangerous because an agent or user may grant the skill broader trust and permissions than intended, leading to unexpected processing of arbitrary documents, network access, and use of unrelated functions.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documentation explicitly includes custom application creation, editing, and management, which materially expands the skill from fixed purchase-order extraction into arbitrary enterprise-defined extraction behavior. That increases the attack surface and undermines the safety assumptions implied by a narrowly scoped extraction skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README shows commands that process local documents and remote URLs via a public cloud service, but it does not clearly warn that document contents and fetched remote files may be transmitted off-host for processing. In a procurement/order context, these documents often contain sensitive commercial, financial, and personal data, so lack of disclosure can lead to unintended data exfiltration and compliance issues.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill instructs users to submit local files, URLs, and Base64-encoded documents to a remote ADP service, but it does not prominently warn that document contents and related metadata will leave the local environment. For purchase orders, this can expose sensitive commercial data such as supplier names, buyer addresses, pricing, quantities, and delivery details to a third-party processor without informed consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The installation section recommends piping remotely fetched shell and PowerShell scripts directly into interpreters, which executes network-delivered code without review, pinning, or integrity verification. If the upstream source, repository, CDN path, or network path is compromised, users could run arbitrary code on their systems during setup.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 98% confidence

Finding

The command fetches a script from an external URL and executes it as part of installation, creating a direct supply-chain and remote-code-execution path. In this skill context, README users may follow the command verbatim, so any compromise of the external source can immediately compromise developer or production systems.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README documents an adp credit command to view remaining service credits. Monitoring account balance is an account-management capability, not a direct requirement for extracting purchase-order data into JSON.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 91% confidence

Finding

The README instructs users to fetch and execute an installation script directly from a remote URL. This is risky because compromise of the GitHub account, repository, branch, or transport chain could turn installation into immediate arbitrary code execution on the user's machine.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Exposing configuration management and credit/account-related commands is outside the expected scope of a document extraction skill and can enable unintended account state changes or information disclosure about service usage. While lower severity than arbitrary extraction features, it still broadens the operational authority available through the skill.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

This command fetches a script from GitHub at runtime and immediately executes its contents, creating a trust-on-first-use dependency on an external source outside the user's control. Any compromise of the repository, referenced branch, or transport path can turn installation into arbitrary code execution.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest scope is narrowly about extracting fields from purchase orders and sales orders, but this section explicitly describes invoices, receipts, IDs/certificates, generic document parsing, and custom extraction as accessible through the same CLI tool. Those capabilities are not justified by the stated purpose of this specific skill and broaden the operational context beyond order extraction.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Static analysis

No suspicious patterns detected.