海关知识产权备案查询

• Outcome: Review
• Latest audit: Sep 16, 2026 · 8:46 AM UTC
• Version: 1.0.0

Overview

This appears to be a customs lookup skill, but it automates a WAF-protected government site, installs unpinned packages at runtime, uses plaintext HTTP, and caches results locally.

Install only if you are authorized to automate this customs lookup site and are comfortable with local package installation, Chrome automation, plaintext HTTP queries, and workspace CSV caching. Prefer running it in an isolated, least-privileged environment, pinning dependencies, disabling automatic mirror fallback, and validating important customs results through an official trusted source before using them for shipping decisions.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: scripts/customs_search.py:194

Finding

Unpinned Runtime Dependency Installation from Multiple Package Indexes

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/customs_search.py:26

Finding

Unauthenticated Plaintext HTTP Transport for Customs Queries and Results

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (15)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script explicitly states it will bypass WAF protections, which is behavior aimed at defeating access controls rather than simply querying a public service. In skill context, that makes the automation materially more dangerous because it normalizes anti-protection evasion against a government system and may violate policy, trigger blocking, or facilitate unauthorized scraping.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documentation disguises risky behavior as a normal customs filing lookup while openly describing WAF bypass, which is a strong indicator of adversarial or at least policy-evading design. That framing is dangerous because operators may approve the skill based on benign business wording without realizing it includes anti-defensive evasion behavior.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scripts/customs_search.py (reported line 698)May include surrounding context.

python

if not _is_in_venv():
        venv_python = _get_venv_python()
        if venv_python:
            os.execv(venv_python, [venv_python] + sys.argv)

    brand = args.brand.strip()
    csv_path = args.cache_file or get_csv_path()

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · 知识产权海关保护备案.csv (reported line 1)May include surrounding context.

text

查询品牌,权利名称,权利人名称,权利人国别,权利号,备案号,权利类别,商品分类,备案状态,备案开始日期,备案截止日期,查询时间
TRW,TRW,TRW知识产权公司,美国,244497,T2016-50578,国内注册,第9类,生效,2026-02-28,2036-02-27,2026-05-25 18:45:37
TRW,TRW,TRW知识产权公司,美国,244496,T2016-50576,国内注册,第9类,生效,2026-02-28,2036-02-27,2026-05-25 18:45:37
TRW,TRW,TRW知识产权公司,美国,244607,T2016-50574,国内注册,第12类,生效,2026-02-28,2036-02-27,2026-05-25 18:45:37

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill directs the agent to run shell commands, inspect environment state, and read/write a CSV cache, but it declares no explicit tool scope or permissions. That creates a least-privilege failure: an agent or runtime may grant broader capabilities than users expect, increasing the chance of unintended command execution, filesystem modification, or environment access.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The activation description lists broad phrases such as "品牌备案", "备案状态", and "品牌合规筛查" alongside the intended customs-IP query phrases. These terms are not specific to the customs filing system and could overlap with ordinary compliance or status-check requests, making unintended invocation more likely.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/customs_search.py (reported line 75)May include surrounding context.

python

try:
        if sys.platform == "win32":
            # Windows 下用 where 命令，指定 encoding 避免 UTF-8 解码错误
            result = subprocess.run(
                ["where", "chrome"],
                capture_output=True, text=True, timeout=5,
                encoding="gbk", errors="replace"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/customs_search.py (reported line 85)May include surrounding context.

python

if os.path.isfile(path):
                    return path
        else:
            result = subprocess.run(
                ["which", "google-chrome"],
                capture_output=True, text=True, timeout=5
            )

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill claims to perform a customs query, but it also creates virtual environments and installs dependencies, which are privileged side effects unrelated to the narrow business purpose. This mismatch increases risk because users and orchestrators may permit the skill expecting read-only query behavior, while it actually performs local environment mutation and network package retrieval.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Creating a virtual environment and later installing packages causes local filesystem and potentially network side effects that are not surfaced as an upfront warning in a supposedly query-only skill. This is dangerous because it breaks least surprise, expands the attack surface, and can violate execution-environment expectations or organizational controls.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/customs_search.py (reported line 126)May include surrounding context.

python

if not os.path.isfile(venv_python):
        print(json.dumps({"action": "create_venv", "path": venv_dir}))
        subprocess.run(
            [sys.executable, "-m", "venv", venv_dir],
            capture_output=True, text=True, timeout=60
        )

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/customs_search.py (reported line 178)May include surrounding context.

python

check_cmd = [sys.executable, "-c", "import nodriver"]

    try:
        r = subprocess.run(
            check_cmd, capture_output=True, text=True, timeout=10,
            encoding="gbk" if sys.platform == "win32" else "utf-8",
            errors="replace"

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 88% confidence

Finding

The script automatically installs a package from PyPI or a mirror at runtime, creating a supply-chain and unexpected system/network modification risk. In an agent skill advertised as a query tool, silently fetching and executing third-party package installation is dangerous because a compromised package, mirror, or dependency chain can lead to arbitrary code execution in the skill environment.

Content

Scanner excerpt · scripts/customs_search.py (reported line 208)May include surrounding context.

python

print(json.dumps({"action": "install_deps", "mirror": mirror, "cmd": " ".join(pip_args)}))

    try:
        result = subprocess.run(pip_args, capture_output=True, text=True, timeout=120)
        if result.returncode == 0:
            return True
        elif not mirror:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The script writes query results to a CSV cache automatically, potentially persisting sensitive business lookup history and rights-holder data without explicit user awareness. In an agent environment, silent file writes can create privacy, retention, and data-governance issues, especially when the workspace may be shared or later exfiltrated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The module docstring, CLI descriptions, and user-facing messages are presented only in Chinese, with no indication that another language is available. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy issue.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.