agentic-doc-parse-and-extract

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:42 AM UTC
• Version: 1.10.3

Overview

This looks like a real cloud document-processing skill, but it asks agents to install and run unverified external code and handle sensitive documents, credentials, and account changes with weak guardrails.

Install only after you trust the ADP provider and understand that selected documents may be sent to Laiye ADP cloud services. Prefer a pinned, verified, local or sandboxed CLI install instead of the one-line remote script installers or unpinned global npm command. Do not paste real API keys into commands that may be logged, and require explicit approval before bulk-processing folders or creating, updating, or deleting custom applications.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T03 · Remote Payload Retrieval and Execution

Error

• Location: references/examples.md:9

Finding

Mutable Remote Installation Scripts Are Downloaded and Immediately Executed

Content

View full analysis

Remediation

View remediation

adp-init.sh" | sha256sum -c - less adp-init.sh bash adp-init.sh ``` 6. Require explicit user approval before executing downloaded code, especially in autonomous Agent environments. 7. Run installation in a restricted, non-administrative account, container, or sandbox. 8. Document the files, network destinations, and configuration changes performed by the installer. 9. Apply the corrected instructions consistently to `README.md`, `README-CN.md`, and `references/examples.md`. ]]>

T08 · Insecure Dependencies

Error

• Location: references/examples.md:9

Finding

Unpinned CLI Package Is Installed Globally from Third-Party Registries

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: references/examples.md:85

Finding

API Keys Are Supplied Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (28)

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The use of '| bash' chains network retrieval directly into command execution, removing any opportunity for review or validation before code runs. Because this is an agent skill README for CLI installation, the context increases danger: automation-oriented users or agents may execute the command as-is, amplifying the chance of silent compromise.

Content

Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用）
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · README.md (reported line 48)May include surrounding context.

md

agentic-doc-parse-and-extract/
├── skill.md                  # Skill configuration and invocation instructions
├── README.md                 # Introduction to Laiye ADP product and instructions for CLI download and invocation
├── references/               # Parameter enumeration, error codes, and JSON return instructions
    ├── examples.md           # Sample code for invocation and return with parameter explanations
    ├── commands.md           # List of all commands
    ├── response-schema.md    # Return parameter description

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

The use of '| bash' chains network retrieval directly into shell execution, collapsing fetch and execute into a single opaque step that prevents meaningful user review. In an AI skill ecosystem, this pattern is particularly risky because it can turn documentation-following behavior into immediate execution of attacker-controlled code if the remote source is altered.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

md

export PATH="$(npm prefix -g)/bin:$PATH"

  # Method 2: Shell script (Linux / macOS, if npm is not available)
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Method 3: PowerShell script (Windows, if npm is not available)
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 99% confidence

Finding

The curl ... | bash construct is a classic command-chaining abuse pattern because it combines retrieval and execution into one step, eliminating an opportunity for inspection or validation. In an agent skill, this is more dangerous because automation may execute the chain non-interactively, turning documentation into a direct RCE path.

Content

Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Method 2: Shell script (Linux / macOS, if npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Method 3: PowerShell script (Windows, if npm is not available)
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code from the network immediately. If the upstream GitHub content, repository, maintainer account, or transport path is compromised, users and agents could run arbitrary commands with the privileges of the invoking user.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The PowerShell example downloads a remote script and immediately executes it without any integrity verification or review step. This creates a straightforward remote code execution path if the hosted script is modified maliciously or the distribution source is compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code from the network with the user's privileges. In an agent-enabled skill context, this is especially dangerous because an AI agent or user following the instructions may perform code execution automatically, and any compromise of the upstream repository, account, or transport path could lead to arbitrary command execution.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The PowerShell example downloads a remote script and immediately executes it without any integrity verification or warning. This creates the same arbitrary code execution risk as the shell example, and the risk is amplified in this skill because installation instructions may be consumed and acted on by automation or AI agents rather than a cautious human reviewer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs users to upload documents and send them to a third-party ADP service, but it does not clearly warn that sensitive document contents will leave the local environment and be processed remotely. Because the supported use cases include invoices, orders, HR files, and identity documents, users may unknowingly transmit PII, financial data, or regulated records to an external provider.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The batch-processing guidance encourages bulk upload of local folders and URL lists without warning that this can result in large-scale transmission of many documents to a remote service. In this skill's context, batch workflows for finance, administration, and HR materially increase the chance of exposing high volumes of sensitive business and personal data.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference includes configuration management, credential setting, credit checks, and cached app listing capabilities that are broader than the advertised skill purpose. This discrepancy can let an agent manipulate persistent configuration or inspect account state, which is dangerous when users believe the skill only processes documents.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 85% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/commands.md (reported line 36)May include surrounding context.

md

| Option | Type | Description |
|--------|------|-------------|
| `--force`, `-y` | boolean | Skip confirmation prompt |

---

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The parsing and extraction commands describe sending local files, URLs, or base64 document contents for processing but provide no warning that sensitive document data will leave the local environment and be transmitted to a remote service. Given this skill targets invoices, receipts, HR records, and identity documents, the omission materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The command reference exposes custom application creation, update, deletion, and AI-assisted configuration features that go beyond the manifest’s stated parsing/extraction scope. In an agent setting, this capability expansion increases the chance that an orchestrator or downstream model invokes state-changing administrative actions the user did not expect, creating a scope-mismatch and potential misuse risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The documented adp schema introspection command enables dynamic discovery of all CLI functions, parameters, and defaults, including capabilities outside the skill’s stated purpose. In agentic workflows this undermines static scoping, because a model can expand its own action set at runtime and identify higher-risk commands to invoke.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The documentation instructs users or agents to fetch a remote shell script and pipe it directly into bash, which executes unverified code immediately. If the upstream repository, network path, or referenced script is compromised, this becomes arbitrary code execution on the host running the installer.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The PowerShell example downloads a remote script to a temporary location and executes it without integrity verification or review. This creates the same arbitrary code execution risk as pipe-to-shell installers, especially dangerous when copied by an agent or user with administrative privileges.

Content

No source excerpt is available for this finding.

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The command fetches executable content from an external URL at runtime, introducing a trust dependency on a mutable remote resource. In this skill context, installation instructions may be copied verbatim by users or agents, making external script fetching especially risky because it can lead to arbitrary code execution through supply-chain compromise.

Content

Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.

md

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用）
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

External Script Fetching

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

This line explicitly fetches an external script from GitHub and pipes it into bash, creating a direct remote-code-execution path. In a document-processing AI skill, external script fetching is more dangerous because users may treat the repository as trusted infrastructure for automated workflows, increasing the chance of blind execution.

Content

Scanner excerpt · README.md (reported line 78)May include surrounding context.

md

export PATH="$(npm prefix -g)/bin:$PATH"

  # Method 2: Shell script (Linux / macOS, if npm is not available)
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Method 3: PowerShell script (Windows, if npm is not available)
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 72% confidence

Finding

The skill instructs the agent to cache APP_IDs in context and store commonly used identifiers in environment variables or configuration files for later reuse. Although framed as a performance optimization, this is a plain-language directive to retain account-scoped user data beyond the immediate task, which can increase unintended disclosure risk in multi-user or shared-agent contexts.

Content

No source excerpt is available for this finding.

Ssd 3

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

This line explicitly says the user's app ID can be remembered for direct use next time, which is a natural-language instruction to retain and reuse account-linked information across interactions. Even though the identifier may not be highly sensitive by itself, the retention behavior can expose user-specific configuration data if context is shared or later surfaced inadvertently.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 10)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 14)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 22)May include surrounding context.

md

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · license.md (reported line 32)May include surrounding context.

md

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

Static analysis

No suspicious patterns detected.