Laiye-OCR

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:07 AM UTC
• Version: 1.10.3

Overview

The skill’s document-processing purpose is coherent, but its first-use setup tells agents to install mutable remote or unpinned global software before handling sensitive documents.

Review this skill before installing. Use only a pinned, verified CLI installation path, avoid pipe-to-shell or immediate PowerShell execution from mutable URLs, and confirm where API keys and app caches are stored. Only upload documents or URL lists you are authorized to send to Laiye ADP, especially for invoices, identity documents, HR files, and financial records.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:77
• Finding: Mutable Remote Installation Scripts Are Downloaded and Executed Without Verification<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:77-81` - `README-CN.md:79-83` - `references/examples.md:13-17` - `SKILL.md:12` directs the Agent to follow the installation instructions in `references/examples.md` **Vulnerability Type**: Unverified remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash ``` ```powershell Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1" ``` ### Technical Analysis The Unix installation command downloads a shell script from an external URL and pipes it directly into `bash`. The Windows command downloads a PowerShell script into a temporary directory and immediately executes it. Neither method verifies a cryptographic checksum, digital signature, release provenance, or expected script contents before execution. Both URLs reference the mutable `main` branch of an external GitHub repository. Consequently, the code that is executed can change after this Skill package has been reviewed. The externally hosted scripts are not included in the audited artifact, so their current or future behavior cannot be established from the project contents. This behavior is not necessary to provide document parsing and extraction. At most, the Skill needs a known, authenticated CLI artifact. Executing mutable remote scripts grants substantially broader capability than retrieving and validating a fixed release. The PowerShell variant avoids a direct network-to-interpreter pipe but does not materially mitigate the risk: the downloaded file is still executed immediately without validation. ### Attack Path 1. An attacker compromises the external repository, a maintainer account, or another part of the remote delivery chain. 2. The attacker modifies `scripts/adp-init.sh` or `scripts/adp-ini ...[truncated 1328 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Remove all direct pipe-to-shell installation commands and immediate execution of unverified temporary scripts. 2. Publish versioned release artifacts and reference an immutable release version or commit rather than the mutable `main` branch. 3. Provide a documented download-and-verify workflow, for example: - Download the installer without executing it. - Verify a publisher-provided SHA-256 digest or cryptographic signature. - Display or make the script available for inspection. - Execute it only after explicit user approval. 4. Store checksums in a separately authenticated release channel. A checksum downloaded from the same mutable location does not provide meaningful protection against repository compromise. 5. Prefer a minimal, audited installer bundled with the Skill if automatic installation is essential. 6. Require explicit user confirmation before installing software or executing any downloaded code. 7. Apply the remediation consistently to `README.md`, `README-CN.md`, and `references/examples.md`. 8. Update `SKILL.md` so that an Agent must not automatically execute installation commands merely because the CLI is absent. ]]>

T08 · Insecure Dependencies

Error

• Location: references/examples.md:10
• Finding: Unpinned CLI Package Is Installed Globally from Third-Party Registries<![CDATA[ ## Vulnerability Details **File Locations**: - `README.md:73-75` - `README-CN.md:76-77` - `references/examples.md:10-11` - `SKILL.md:12` directs the Agent to perform this installation on first execution **Vulnerability Type**: Unpinned and globally installed third-party dependency **Risk Level**: High ### Vulnerable Code ```bash npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli ``` ### Technical Analysis The installation command does not specify an exact package version or integrity digest. It therefore resolves whatever package version the selected registry considers current at execution time. The first installation attempt uses `registry.npmmirror.com`; if that fails, the shell automatically retries against the configured/default npm registry. The audited project contains no copy of the CLI source, package lockfile, integrity record, or dependency manifest that would allow the installed implementation to be reviewed. npm packages may also execute lifecycle scripts during installation. If the package, one of its dependencies, a publisher account, or a serving registry is compromised, malicious code may execute during installation. The `-g` option installs the package globally rather than isolating it to this project. This increases the effect on the user's environment by placing the `adp` command in a global npm location and potentially making the installed implementation available to unrelated sessions and projects. Because subsequent Skill operations invoke `adp`, a compromised installation could also impersonate the expected CLI while receiving API credentials and sensitive documents. ### Attack Path 1. An attacker compromises the package publisher, an upstream dependency, or one of the registries used by the command. 2. A malicious package version or dependency is published or served. 3. The Agent follows the first-run instal ...[truncated 1293 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the CLI to a specific, reviewed version rather than installing the latest available package. 2. Publish and verify package integrity metadata or a cryptographic signature tied to that exact release. 3. Commit a dependency manifest and lockfile where applicable so dependency resolution is reproducible. 4. Prefer a project-local installation over `npm install -g` to reduce system-wide effects and prevent unrelated sessions from automatically using the package. 5. Use a single explicitly trusted registry. Do not silently switch between registries with a shell fallback unless both sources are independently authenticated and expected to provide identical verified content. 6. Review npm lifecycle scripts and consider installation with lifecycle scripts disabled when they are not required. 7. Require explicit user approval before installing the package. 8. After installation, verify that the resolved executable belongs to the expected package and version before passing documents or credentials to it. 9. Apply version and integrity controls consistently in both READMEs and `references/examples.md`. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (28)

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用）
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

• Confidence: 98% confidence
• Finding: The '| bash' pattern is a classic chaining abuse primitive because it combines network retrieval with immediate command execution in one step, eliminating inspection and increasing the blast radius of any upstream compromise. In a tool intended for AI agent and automation workflows, such a one-liner may be copied into privileged environments, amplifying supply-chain and remote code execution risk.

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

agentic-doc-parse-and-extract/
├── skill.md                  # Skill configuration and invocation instructions
├── README.md                 # Introduction to Laiye ADP product and instructions for CLI download and invocation
├── references/               # Parameter enumeration, error codes, and JSON return instructions
    ├── examples.md           # Sample code for invocation and return with parameter explanations
    ├── commands.md           # List of all commands
    ├── response-schema.md    # Return parameter description

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Chaining Abuse

High

• Category: Tool Misuse

Content

export PATH="$(npm prefix -g)/bin:$PATH"

  # Method 2: Shell script (Linux / macOS, if npm is not available)
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Method 3: PowerShell script (Windows, if npm is not available)
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

• Confidence: 95% confidence
• Finding: The shell pipeline chains network retrieval directly into execution, which is a classic abuse-enabling pattern because it combines untrusted input with immediate command execution. In the context of an agent skill, the installation guidance may be followed automatically, increasing the likelihood of remote code execution on developer or automation hosts.

Chaining Abuse

High

• Category: Tool Misuse

Content

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

# Method 2: Shell script (Linux / macOS, if npm is not available)
curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

# Method 3: PowerShell script (Windows, if npm is not available)
Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

• Confidence: 99% confidence
• Finding: The `curl ... | bash` pattern is a classic command-chaining anti-pattern because it removes any opportunity for inspection between retrieval and execution of remote code. In an agent skill context, this is even more dangerous because automated systems may run the command non-interactively, enabling immediate arbitrary code execution on developer or CI hosts.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README instructs users to fetch a remote shell script and pipe it directly into bash, which executes unreviewed code from the network immediately. If the GitHub account, repository, branch, or delivery path is compromised—or if the script changes unexpectedly—users could run arbitrary code on their systems with their current privileges.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The PowerShell command downloads a remote script to a temporary path and immediately executes it without integrity verification or user review. This creates the same arbitrary code execution risk as pipe-to-shell installers and is especially dangerous because the script source is mutable and remotely controlled.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code immediately. If the upstream GitHub content, repository, network path, or maintainer account is compromised, users and AI agents could run arbitrary commands on the host with the user's privileges.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The PowerShell example downloads a remote script and immediately executes it, creating the same arbitrary code execution risk as curl|bash. A compromised source, MITM in a misconfigured environment, or malicious script update could lead to full execution of attacker-controlled commands on Windows systems.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs agents to upload local files or provide document URLs to a third-party remote processing service, but it does not clearly require user consent, data minimization, or prominent warnings about transmitting potentially sensitive content such as invoices, receipts, HR records, and identity documents. In this context, the omission is material because the skill is designed for high-frequency processing of financial and personal documents, so an agent could exfiltrate sensitive data off-host as part of normal operation without the user fully understanding the privacy implications.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The reference explains how to set and override API keys but provides no guidance on secure credential handling. In an agent workflow, that omission can encourage passing secrets on the command line or storing them insecurely, which may leak through shell history, logs, process listings, or shared configuration.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| Option | Type | Description |
|--------|------|-------------|
| `--force`, `-y` | boolean | Skip confirmation prompt |

---

• Confidence: 85% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `adp parse url <url>` command causes the CLI/service to fetch remote content, and the documentation does not warn users that document data from arbitrary URLs will be retrieved and sent for processing. In an agentic context, this omission can lead to unreviewed transmission of sensitive internal documents or access to attacker-controlled URLs, increasing data exposure and SSRF-like risk through unsafe operator use.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The `adp extract url <url>` command similarly operates on remote documents but omits any notice that external resources will be fetched and processed. For a document-processing skill handling invoices, IDs, and HR records, this creates a meaningful risk of sensitive data exfiltration or interaction with attacker-supplied URLs without informed user consent.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The delete commands for custom applications and versions are destructive and the reference does not explicitly warn about permanence or operational consequences. In an agent-integrated environment, this can increase the chance of accidental deletion of production extraction configurations, causing service disruption or loss of business-critical processing logic.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The installation instructions tell users to execute downloaded shell and PowerShell scripts from a remote URL without any warning or integrity verification guidance. Running unverified remote installer scripts can result in arbitrary code execution on the host if the source, repository, network path, or script content is compromised.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The configuration examples show direct API key handling via CLI commands without any warning about shell history exposure, process-list leakage, or secret storage hygiene. This can lead users or agents to paste long-lived credentials into commands or logs, increasing the chance of credential compromise and unauthorized use of the document-processing service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The examples instruct users to send local documents, document URLs, and extracted contents to a remote ADP service, including potentially sensitive finance, HR, invoice, receipt, and identity-document data, but provide no privacy, consent, retention, or data-handling warning. In the context of this skill, that omission is especially risky because the advertised use cases explicitly involve high-sensitivity personal and business documents, so users may unknowingly exfiltrate regulated or confidential data to a third party.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: This README presents the skill content in Simplified Chinese and does not state within the text that the user can choose their preferred language before proceeding. Although an English link exists, the document itself defaults to a specific language presentation, which may conflict with a language-choice policy if user opt-in is required.

External Script Fetching

Low

• Category: Supply Chain

Content

npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli

  # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用）
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用）
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

• Confidence: 94% confidence
• Finding: The command performs external script fetching from a remote GitHub raw URL and immediately routes it into shell execution. In the context of an agent skill README, this is more dangerous because agents or users may follow installation instructions verbatim, turning documentation into a code execution path.

External Script Fetching

Low

• Category: Supply Chain

Content

export PATH="$(npm prefix -g)/bin:$PATH"

  # Method 2: Shell script (Linux / macOS, if npm is not available)
  curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash

  # Method 3: PowerShell script (Windows, if npm is not available)
  Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

• Confidence: 94% confidence
• Finding: This finding correctly identifies external script fetching tied directly to execution from a mutable remote URL. In a skill intended for AI-assisted terminal use, this is more dangerous because an agent may follow the README non-interactively and execute untrusted installation code without human review.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

1. Licensing

1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to:
Personal learning, research, teaching, and evaluation.
Technical exchanges within academic institutions or open-source communities, non-profit projects.
Integration or demonstration in non-commercial products or services.

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Scope Creep

Low

• Category: Excessive Agency

Content

4. Disclaimer of Warranties

THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT.

5. Termination

• Confidence: 70% confidence
• Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Missing User Warnings

Low

• Confidence: 82% confidence
• Finding: `adp config clear` clears all configuration, and while the option table mentions `--force` to skip confirmation, the surrounding documentation does not explicitly warn that saved configuration and credentials will be removed. In markdown, potentially destructive behaviours should be clearly disclosed to the user.

Static analysis

No suspicious patterns detected.