中国机动车出厂合格证识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

The skill largely performs the advertised vehicle-certificate extraction, but its installation and documentation expose users to review-worthy supply-chain and scope risks.

Install only if you are comfortable using Laiye ADP's cloud service for vehicle-certificate data and API-key based access. Prefer a pinned, verified release or reviewed local installer over the documented curl-to-bash, PowerShell invoke-expression, or unpinned global npm install, and avoid letting an agent use the broader custom-app management commands unless you explicitly intend that administration.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Mutable Remote Installer Is Downloaded and Executed Without Verification

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:63
• README.md:30
• README-CN.md:29

Vulnerability Type: Remote payload retrieval and immediate execution
Risk Level: High

Complete Vulnerable Code Snippet:

bash

curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

The installation sections also present the same unsafe execution pattern for Windows:

powershell

irm https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1 | iex

Technical Analysis

The documented command retrieves an installation script from the mutable main branch of an external GitHub repository and sends the response directly to a command interpreter. There is no immutable commit or release pin, cryptographic signature, checksum, or manual review step.

Consequently, the effective code executed by users is not contained in this Skill and may change at any time after the Skill has been reviewed. Although the repository name is consistent with the advertised vendor, the safety and future integrity of the external scripts cannot be established from this package.

The PowerShell alternative has the same security property: irm downloads mutable content and iex immediately evaluates it as code.

This exceeds the minimum privileges necessary for the declared document-extraction functionality. Installing a CLI may be necessary, but executing an unverified, mutable remote script is not. A pinned and cryptographically verified release artifact would provide the required functionality with substantially lower supply-chain risk.

Attack Path

1. An attacker compromises the external repository, a maintainer account, the release workflow, or another component capable of modifying the referenced main branch.
2. The attacker replaces or modifies scripts/adp-init.sh or scripts/adp-init.ps1 with a malicious payload.
3. A user or AI Agent follows the ...[truncated 1132 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove all direct curl | bash and irm | iex installation instructions.
2. Pin downloads to an immutable release version or full Git commit rather than the mutable main branch.
3. Download the installer as a separate file before execution.
4. Publish a SHA-256 checksum or, preferably, a cryptographic signature through an independently protected release channel.
5. Require users to verify the checksum or signature before running the installer.
6. Encourage inspection of the downloaded script before execution.
7. Run installation with an unprivileged account and avoid sudo or administrator execution unless a specific operation demonstrably requires it.
8. Prefer a signed package from an established package repository or a verified, versioned GitHub Release artifact.
9. Apply equivalent changes consistently to SKILL.md, README.md, and README-CN.md.

A safer installation flow would download a fixed release artifact, verify its published digest, and only then execute or install it.

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58

Finding

Unpinned Globally Installed npm Dependency Creates a Supply-Chain Risk

Content

View full analysis

Vulnerability Details

File Locations:

• SKILL.md:58
• README.md:25
• README-CN.md:24

Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Complete Vulnerable Code Snippet:

bash

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

Technical Analysis

The installation command does not specify an exact package version or independently verified integrity value. npm therefore resolves a current version according to registry metadata at installation time. The code installed and executed by future users may differ from the version that existed when this Skill was audited.

npm packages may execute lifecycle scripts during installation, and the installed CLI subsequently processes local documents and has access to the user's ADP API credentials. A compromised publisher account, package release pipeline, or registry artifact could therefore introduce arbitrary code outside the reviewed Skill.

The -g flag installs the package globally. While global installation is not itself privilege escalation, it broadens the installation's effect on the user's environment and may become especially dangerous if users invoke npm with administrator privileges.

Attack Path

1. An attacker compromises the npm publisher account, package build pipeline, or registry artifact.
2. The attacker publishes a malicious version under the legitimate package name.
3. A user follows the unpinned installation command.
4. npm resolves and installs the malicious release because no audited version is specified.
5. Malicious lifecycle code may execute during installation, or malicious CLI code executes when the user invokes adp.
6. The code inherits the invoking user's filesystem, network, environment-variable, and credential access.

Impact Assessment

A compromised dependency could execute arbitrary code with the installing or invoking user's privileges. Potential consequ ...[truncated 627 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the CLI to an exact version that has been reviewed instead of installing the latest available release.
2. Record and verify npm package integrity and provenance information.
3. Document the reviewed package version and update it only through a controlled dependency-review process.
4. Prefer a project-local installation where practical instead of modifying the global package environment.
5. Explicitly warn users not to run npm with sudo or administrator privileges.
6. Review package lifecycle scripts and the published package contents before approving a version.
7. Use npm provenance attestations, signed releases, and protected publisher accounts with multi-factor authentication.
8. Keep the pinned version and verification instructions synchronized across all three documentation files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The shell pipe into bash is a classic dangerous chaining pattern because it combines retrieval and execution into a single step with no inspection, validation, or integrity checking. If the remote script is modified maliciously or served unexpectedly, the user executes hostile code immediately under their local privileges.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

Piping curl output directly into bash removes the user's opportunity to inspect the fetched content and creates a classic arbitrary code execution path. In the context of an AI skill README, this is especially risky because agents or users may copy the command verbatim, executing attacker-controlled or unexpectedly changed code immediately.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash pattern is a direct command-chaining anti-pattern that turns remote content retrieval into immediate code execution without validation. In a skill context, this is especially risky because users may treat the documented command as trusted setup guidance and execute it verbatim, enabling silent compromise if the fetched content changes or is maliciously replaced.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a broad, general-purpose ADP CLI for arbitrary document parsing, remote URL processing, and custom application workflows, while the skill metadata claims a narrowly scoped vehicle certificate extraction skill. This scope mismatch increases attack surface and user/operator confusion, because an agent or user may invoke capabilities far beyond the declared purpose and trust boundary of the skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README provides installation commands that directly execute remotely fetched shell and PowerShell scripts, but does not warn users about the risks of arbitrary code execution or recommend integrity verification. This is dangerous because compromise of the upstream repository, transport, or referenced script could immediately lead to execution of attacker-controlled code on the host.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Documenting create/update/delete operations for custom extraction apps is inconsistent with a fixed-purpose vehicle certificate extraction skill. These management capabilities can let a caller alter extraction logic or pivot into broader platform administration tasks that exceed the expected permissions and trust model of the skill.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README advertises a general-purpose ADP CLI with capabilities far beyond the skill's declared purpose of vehicle certificate recognition and extraction. This scope mismatch is dangerous because an agent or user may invoke broader parsing, remote fetching, app management, or automation features under the guise of a narrowly scoped skill, increasing the attack surface and enabling unintended document handling.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README encourages processing remote URLs and exporting results to local files without clearly warning that document contents may be transmitted to a cloud service and written to disk. For sensitive vehicle certificate data, this creates confidentiality and privacy risks, especially if users or agents assume processing is local or fail to control where outputs are stored.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Documenting create, update, and delete operations for custom extraction applications exceeds the stated ready-to-use extraction purpose and introduces unnecessary administrative and mutating actions. In an agent context, these commands could be misused to alter configurations, delete resources, or expand processing behavior beyond what the skill consumer expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill encourages uploading and extracting highly sensitive vehicle certificate data, including VIN/frame numbers and engine numbers, but provides little practical guidance on privacy, consent, retention, redaction, or regulatory handling. Because this workflow transmits identity-linked document data to an external cloud service, users may expose personal or regulated information without understanding the data-handling implications.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The command fetches a shell script from a remote URL and pipes it directly into bash, creating an immediate arbitrary code execution path. In the context of a skill README, users may treat this as a trusted setup step, which makes the pattern especially risky because it normalizes blind execution of network-delivered code.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The README instructs users to execute an installation script fetched directly from a remote URL. This is dangerous because any compromise of the source repository, distribution path, or network trust chain could result in arbitrary code execution on the user's machine during installation.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The skill instructs users to fetch a remote shell script over the network and immediately execute it via a pipe to bash. If the upstream repository, transport path, or referenced script is compromised, arbitrary code will run on the user's machine with the user's privileges, creating a straightforward supply-chain execution risk.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

This JSON file contains natural-language labels and extracted values predominantly in Chinese, such as field names and date/value formats, with no accompanying indication that the skill is limited to a Chinese-language context or that users can opt into this locale. Under the language/locale policy rule, forcing a specific language without documented choice or justification can be a policy concern.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination