Security audit

Laiye-OCR

Security checks for vulnerabilities and agentic risk

Overview

The skill’s document-processing purpose is coherent, but its first-use setup tells agents to install mutable remote or unpinned global software before handling sensitive documents.

Review this skill before installing. Use only a pinned, verified CLI installation path, avoid pipe-to-shell or immediate PowerShell execution from mutable URLs, and confirm where API keys and app caches are stored. Only upload documents or URL lists you are authorized to send to Laiye ADP, especially for invoices, identity documents, HR files, and financial records.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

Location: README.md:77
Finding: Mutable Remote Installation Scripts Are Downloaded and Executed Without Verification
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/examples.md:10
Finding: Unpinned CLI Package Is Installed Globally from Third-Party Registries
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults

Findings (28)

Chaining Abuse

High

Category: Tool Misuse
Confidence: 98% confidence
Finding: The '| bash' pattern is a classic chaining abuse primitive because it combines network retrieval with immediate command execution in one step, eliminating inspection and increasing the blast radius of any upstream compromise. In a tool intended for AI agent and automation workflows, such a one-liner may be copied into privileged environments, amplifying supply-chain and remote code execution risk.
Content: Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用） curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用） Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · README.md (reported line 48)May include surrounding context.
md
agentic-doc-parse-and-extract/ ├── skill.md # Skill configuration and invocation instructions ├── README.md # Introduction to Laiye ADP product and instructions for CLI download and invocation ├── references/ # Parameter enumeration, error codes, and JSON return instructions ├── examples.md # Sample code for invocation and return with parameter explanations ├── commands.md # List of all commands ├── response-schema.md # Return parameter description

Chaining Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The shell pipeline chains network retrieval directly into execution, which is a classic abuse-enabling pattern because it combines untrusted input with immediate command execution. In the context of an agent skill, the installation guidance may be followed automatically, increasing the likelihood of remote code execution on developer or automation hosts.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
md
export PATH="$(npm prefix -g)/bin:$PATH" # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Chaining Abuse

High

Category: Tool Misuse
Confidence: 99% confidence
Finding: The curl ... | bash pattern is a classic command-chaining anti-pattern because it removes any opportunity for inspection between retrieval and execution of remote code. In an agent skill context, this is even more dangerous because automated systems may run the command non-interactively, enabling immediate arbitrary code execution on developer or CI hosts.
Content: Scanner excerpt · references/examples.md (reported line 14)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users to fetch a remote shell script and pipe it directly into bash, which executes unreviewed code from the network immediately. If the GitHub account, repository, branch, or delivery path is compromised—or if the script changes unexpectedly—users could run arbitrary code on their systems with their current privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The PowerShell command downloads a remote script to a temporary path and immediately executes it without integrity verification or user review. This creates the same arbitrary code execution risk as pipe-to-shell installers and is especially dangerous because the script source is mutable and remotely controlled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The README instructs users to pipe a remotely fetched shell script directly into bash, which executes unreviewed code immediately. If the upstream GitHub content, repository, network path, or maintainer account is compromised, users and AI agents could run arbitrary commands on the host with the user's privileges.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The PowerShell example downloads a remote script and immediately executes it, creating the same arbitrary code execution risk as curl|bash. A compromised source, MITM in a misconfigured environment, or malicious script update could lead to full execution of attacker-controlled commands on Windows systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill explicitly instructs agents to upload local files or provide document URLs to a third-party remote processing service, but it does not clearly require user consent, data minimization, or prominent warnings about transmitting potentially sensitive content such as invoices, receipts, HR records, and identity documents. In this context, the omission is material because the skill is designed for high-frequency processing of financial and personal documents, so an agent could exfiltrate sensitive data off-host as part of normal operation without the user fully understanding the privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The reference explains how to set and override API keys but provides no guidance on secure credential handling. In an agent workflow, that omission can encourage passing secrets on the command line or storing them insecurely, which may leak through shell history, logs, process listings, or shared configuration.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 85% confidence
Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content: Scanner excerpt · references/commands.md (reported line 36)May include surrounding context.
md
| Option | Type | Description | |--------|------|-------------| | `--force`, `-y` | boolean | Skip confirmation prompt | ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The adp parse url <url> command causes the CLI/service to fetch remote content, and the documentation does not warn users that document data from arbitrary URLs will be retrieved and sent for processing. In an agentic context, this omission can lead to unreviewed transmission of sensitive internal documents or access to attacker-controlled URLs, increasing data exposure and SSRF-like risk through unsafe operator use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The adp extract url <url> command similarly operates on remote documents but omits any notice that external resources will be fetched and processed. For a document-processing skill handling invoices, IDs, and HR records, this creates a meaningful risk of sensitive data exfiltration or interaction with attacker-supplied URLs without informed user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The delete commands for custom applications and versions are destructive and the reference does not explicitly warn about permanence or operational consequences. In an agent-integrated environment, this can increase the chance of accidental deletion of production extraction configurations, causing service disruption or loss of business-critical processing logic.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The installation instructions tell users to execute downloaded shell and PowerShell scripts from a remote URL without any warning or integrity verification guidance. Running unverified remote installer scripts can result in arbitrary code execution on the host if the source, repository, network path, or script content is compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The configuration examples show direct API key handling via CLI commands without any warning about shell history exposure, process-list leakage, or secret storage hygiene. This can lead users or agents to paste long-lived credentials into commands or logs, increasing the chance of credential compromise and unauthorized use of the document-processing service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples instruct users to send local documents, document URLs, and extracted contents to a remote ADP service, including potentially sensitive finance, HR, invoice, receipt, and identity-document data, but provide no privacy, consent, retention, or data-handling warning. In the context of this skill, that omission is especially risky because the advertised use cases explicitly involve high-sensitivity personal and business documents, so users may unknowingly exfiltrate regulated or confidential data to a third party.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: This README presents the skill content in Simplified Chinese and does not state within the text that the user can choose their preferred language before proceeding. Although an English link exists, the document itself defaults to a specific language presentation, which may conflict with a language-choice policy if user opt-in is required.
Content: No source excerpt is available for this finding.

External Script Fetching

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: The command performs external script fetching from a remote GitHub raw URL and immediately routes it into shell execution. In the context of an agent skill README, this is more dangerous because agents or users may follow installation instructions verbatim, turning documentation into a code execution path.
Content: Scanner excerpt · README-CN.md (reported line 80)May include surrounding context.
md
npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli --registry=https://registry.npmmirror.com/ || npm install -g @laiye-adp/agentic-doc-parse-and-extract-cli # 方法 2: Shell 脚本（Linux / macOS，无 npm 环境时使用） curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # 方法 3: PowerShell 脚本（Windows，无 npm 环境时使用） Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

External Script Fetching

Low

Category: Supply Chain
Confidence: 94% confidence
Finding: This finding correctly identifies external script fetching tied directly to execution from a mutable remote URL. In a skill intended for AI-assisted terminal use, this is more dangerous because an agent may follow the README non-interactively and execute untrusted installation code without human review.
Content: Scanner excerpt · README.md (reported line 78)May include surrounding context.
md
export PATH="$(npm prefix -g)/bin:$PATH" # Method 2: Shell script (Linux / macOS, if npm is not available) curl -fsSL https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.sh | bash # Method 3: PowerShell script (Windows, if npm is not available) Invoke-WebRequest -Uri "https://raw.githubusercontent.com/laiye-ai/adp-cli/main/scripts/adp-init.ps1" -OutFile "$env:TEMP\adp-init.ps1"; & "$env:TEMP\adp-init.ps1"

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 10)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 14)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 22)May include surrounding context.
md
1. Licensing 1.1 Free Use and Distribution: The Licensor grants the Licensee a non-transferable, non-exclusive right to freely use, copy, publish, and distribute copies of the Product for non-commercial purposes. The aforementioned "non-commercial purposes" include, but are not limited to: Personal learning, research, teaching, and evaluation. Technical exchanges within academic institutions or open-source communities, non-profit projects. Integration or demonstration in non-commercial products or services.

Scope Creep

Low

Category: Excessive Agency
Confidence: 70% confidence
Finding: Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.
Content: Scanner excerpt · license.md (reported line 32)May include surrounding context.
md
4. Disclaimer of Warranties THE PRODUCT IS PROVIDED "AS IS", WITHOUT WARRANTIES OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO: THE LICENSOR DOES NOT WARRANT THAT THE PRODUCT IS FREE FROM ERRORS, BUGS, WILL OPERATE PROPERLY, OR IS SUITABLE FOR A PARTICULAR PURPOSE; THE LICENSOR DOES NOT WARRANT THAT USE OF THE PRODUCT WILL NOT INFRINGE UPON THIRD-PARTY RIGHTS; THE LICENSOR SHALL NOT BE LIABLE TO THE LICENSEE OR ANY THIRD PARTY FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, OR PUNITIVE DAMAGES ARISING FROM THE USE OF THE PRODUCT. 5. Termination

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: adp config clear clears all configuration, and while the option table mentions --force to skip confirmation, the surrounding documentation does not explicitly warn that saved configuration and credentials will be removed. In markdown, potentially destructive behaviours should be clearly disclosed to the user.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.