Security audit

企业风险排查

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed Qixin enterprise risk lookup client, with expected external API use and no hidden persistence, exfiltration, or destructive behavior found.

Install only if you intend to send company names or enterprise IDs to Qixin using your QXBENT_API_TOKEN. For important diligence decisions, prefer an exact enterprise ID and confirm that the returned ename is the company you meant to query. Review resolved npm dependency versions during install because the package does not include a lockfile.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

Natural-Language Policy Violations

Medium

Confidence: 96% confidence
Finding: All user-facing description and usage examples are written in Chinese, and the file does not indicate that language choice is optional or that the skill is intentionally restricted to a Chinese-speaking or China-specific user context. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example "这家公司是不是空壳公司？帮我查一下风险" uses a generic phrase like "帮我查一下风险" without clearly constraining the skill to enterprise risk-assessment contexts. In markdown skill descriptions, broad natural-language examples like this can contribute to unintended invocation because they resemble ordinary user requests rather than a narrowly scoped trigger.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill states that when an enterprise name cannot be precisely matched, it will automatically use the first search result. In a risk-assessment workflow, this can cause analysis and downstream decisions to be made on the wrong company, leading to severe integrity failures, misdirected due diligence, and possible disclosure of sensitive business intelligence about an unintended target.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The method sends the user-provided enterprise name to a remote service via POST, but this file contains no confirmation prompt, logging, or user-facing warning that the data will be transmitted externally. For code files, outbound network transmission of user or system data should have some visible disclosure unless clearly covered elsewhere.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This method posts a company identifier to an external endpoint, yet the file provides no confirmation, visible log, or warning that the identifier leaves the local environment. Under the code-file criteria, network calls carrying user data should include some form of disclosure unless already clearly documented.

Vague Triggers

Low

Confidence: 82% confidence
Finding: This is a manifest file, so vague-trigger review applies. The description only states the skill's broad capabilities and domain, but provides no explicit trigger phrases, activation scope, or exclusion conditions, which can make invocation boundaries unclear in agent selection contexts.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "author": "", "license": "MIT", "dependencies": { "axios": "^1.6.0" }, "devDependencies": { "@types/node": "^20.0.0",
Confidence: 94% confidence
Finding: Using a caret range for axios allows installs of newer matching releases without a fully reproducible dependency set. Because axios has a history of security advisories and this skill likely performs network requests for enterprise risk checks, an affected resolved version could expose the skill to issues such as SSRF, proxy bypass, or request/response manipulation depending on usage.

Unverifiable Dependency: axios has 16 known advisory(ies) (CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

Category: Supply Chain
Confidence: 92% confidence
Finding: The manifest references axios with a non-exact version, so it is impossible to verify from package.json alone whether the installed release includes fixes for known axios advisories. In a skill that likely calls external services and processes potentially sensitive enterprise data, uncertainty around a historically vulnerable HTTP client raises meaningful supply-chain and network-security risk.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "axios": "^1.6.0" }, "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" }
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: }, "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" } }
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Unpinned Dependencies

Low

Category: Supply Chain
Content: "devDependencies": { "@types/node": "^20.0.0", "ts-node": "^10.9.0", "typescript": "^5.0.0" } }
Confidence: 40% confidence
Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Natural-Language Policy Violations

Low

Confidence: 76% confidence
Finding: The class documentation and user-facing error text are written only in Chinese, and the file does not indicate that language is configurable or user-selected. This can violate language/locale policy when a skill implicitly forces a specific language without opt-in.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: The thrown error message is a natural-language string presented only in Chinese, with no evidence of locale negotiation or user preference handling. Policy guidance says to flag language forcing unless the locale constraint is explicitly justified or optional.

Static analysis

No suspicious patterns detected.