中国机动车行驶证识别与抽取（ADP）

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:45 AM UTC
• Version: 1.0.0

Overview

The skill is mostly aligned with vehicle-license extraction, but it asks users to run unverified remote installers and documents broader cloud document-processing powers than the stated purpose needs.

Install only after reviewing the ADP CLI source or using a pinned, verified release. Do not run the pipe-to-shell or irm-to-iex commands blindly. Treat vehicle-license images and extracted JSON as sensitive personal/business data, confirm that uploading them to Laiye ADP is allowed for your use case, and avoid using the broader custom-app or arbitrary-document commands unless you explicitly intend that scope.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:63

Finding

Mutable Remote Installation Scripts Are Executed Without Verification

Content

View full analysis

Remediation

View remediation

/scripts/adp-init.sh printf '%s %s\n' '' 'adp-init.sh' | sha256sum --check less adp-init.sh bash adp-init.sh ``` 7. Provide equivalent `Get-FileHash` and signature-verification steps for Windows. 8. Require explicit user approval before executing installation code, especially when an AI agent initiates the workflow. 9. Run installation with ordinary user privileges and clearly state that elevation is neither requested nor expected. 10. Vendor the auditable installer source inside the Skill package where feasible. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58

Finding

Unpinned npm Package Is Installed Globally

Content

View full analysis

Remediation

View remediation

``` 2. Prefer a project-local installation instead of `npm install -g`. 3. Commit a lockfile containing npm integrity metadata and use `npm ci` for reproducible installation. 4. Review package lifecycle scripts and published package contents before approval. 5. Where lifecycle scripts are not required, consider installing with `--ignore-scripts`; confirm that this does not break legitimate setup behavior. 6. For distributed binaries, publish signed, versioned artifacts with independently verifiable checksums. 7. Require explicit user consent before an AI agent installs or updates dependencies. 8. Document the exact audited CLI version supported by the Skill and establish a controlled update and re-audit process. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README describes a broad ADP document parsing/extraction CLI with multi-document, multi-app, and agentic capabilities rather than a narrowly scoped vehicle-license-recognition skill. This scope mismatch can cause an agent or user to invoke unintended capabilities, increasing the attack surface and enabling processing of arbitrary documents beyond the declared skill purpose.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash construct is a classic command-chaining risk because it executes unreviewed network content in a single step with no integrity validation or human inspection. In an agent or copy-paste workflow, this pattern is especially dangerous because it normalizes blind code execution and can lead to full host compromise.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

Using curl ... | bash creates a direct command execution chain from network content to a shell interpreter with no verification or review step. In the context of an AI skill README, this is especially dangerous because agents or users may copy the command verbatim, enabling one-step remote code execution if the fetched content is altered or malicious.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 98% confidence

Finding

The | bash pattern turns remote content retrieval into immediate command execution, eliminating an opportunity for review and making any upstream compromise instantly actionable. In the context of a skill meant for broad user adoption, this is especially risky because users may copy-paste the command verbatim and unknowingly run malicious code with their local user privileges.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README encourages processing remote URLs and exporting results to local files without prominently warning that documents may be transmitted to a cloud service and that extracted data will be written to disk. Because the skill handles sensitive identity and vehicle-registration data, this omission raises privacy and data-handling risks in real deployments.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented custom application management commands allow creating, updating, and deleting extraction applications, which are unrelated to the advertised vehicle license extraction task. In an agent setting, exposing these controls can let the skill mutate processing behavior or expand into arbitrary extraction workflows, violating least privilege.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README describes a broad, general-purpose ADP CLI with capabilities far beyond the declared skill of Chinese vehicle license recognition and extraction. This mismatch is dangerous because an agent or user expecting a narrowly scoped OCR skill could instead be induced to invoke parsing, extraction, remote URL processing, and app-management functions on arbitrary documents, expanding data exposure and operational scope well beyond least privilege.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Documenting custom application creation, editing, and management in a fixed-purpose skill introduces unnecessary authority and scope expansion. In an agent setting, this can enable repurposing the skill for arbitrary extraction tasks or modifying processing behavior, undermining trust boundaries and increasing the chance of misuse or accidental processing of unrelated sensitive documents.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README encourages local and remote document processing plus export of results without prominently warning that document contents and metadata may be transmitted to a public cloud service and written to local storage. Because the skill handles identity-bearing vehicle registration documents, this omission materially increases privacy and compliance risk, especially when users or agents process sensitive PII by default.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill processes highly sensitive identity and vehicle-registration data, but the description does not clearly warn users that uploaded license images and extracted fields are sent to Laiye's remote ADP service. This creates a meaningful privacy and compliance risk because users may unknowingly transmit PII, vehicle identifiers, and address data off-device to a third party.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The installation section recommends piping remote content directly into shell and PowerShell interpreters without a prominent warning or integrity-verification guidance. This is dangerous because any compromise of the source repository, transport path, or referenced script could lead users to execute attacker-controlled code on their systems.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The installation instruction fetches a remote shell script directly from GitHub and executes it immediately. If the remote content, repository, network path, or referenced branch is compromised, users can execute arbitrary code on their machines.

Content

Scanner excerpt · README-CN.md (reported line 29)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The README instructs users to fetch and execute a remote shell script directly from GitHub. This is dangerous because any compromise of the source repository, distribution path, or network trust chain can immediately translate into arbitrary code execution on the user's machine during installation.

Content

Scanner excerpt · README.md (reported line 30)May include surrounding context.

bash

# Method 2: Shell script (Linux / macOS, when npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 92% confidence

Finding

This command fetches a script from a remote URL and executes it locally, which inherently trusts the remote source at runtime. Even if intended as a convenience installer, it expands the attack surface by allowing upstream compromise or script tampering to become immediate local code execution.

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

bash

# 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

bash

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Static analysis

No suspicious patterns detected.