进出口许可文档智能预审系统

• Outcome: Review
• Latest audit: May 28, 2026 · 9:33 AM UTC
• Version: 1.3.0

Overview

This document-audit skill appears related to its stated purpose, but it can automatically modify the host system and send sensitive document contents to an LLM without a clear consent boundary.

Install only in a controlled or disposable environment unless you are comfortable with automatic system dependency installation and external LLM processing of trade/license documents. Review the installer commands first, use only approved model endpoints and credentials, avoid highly sensitive documents, and clean generated reports, extracted files, temporary OCR data, and cached model config after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: Advertising automatic installation of Node.js, Python, Poppler, Tesseract, and related tooling is dangerous because it expands the skill from document analysis into host modification. When paired with unattended installation and downloaded installers, this introduces supply-chain and arbitrary command execution risk well beyond the core business function.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill automatically installs dependencies at runtime before processing user input. This expands the trust boundary from local code to external package sources and enables execution of newly fetched code without explicit user approval, which is risky for a document-audit tool that should not need self-modifying or network bootstrap behavior during normal operation.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The code sends extracted document text, potentially including contracts, importer identities, certificate numbers, and financial values, to an LLM via callLLM. For an import/export license pre-audit system, these documents are likely sensitive commercial or regulated records, so transmitting them to an external model or service creates a real confidentiality and compliance risk, especially since the manifest does not clearly disclose that behavior.

Intent-Code Divergence

Medium

• Confidence: 93% confidence
• Finding: The rule is intended to verify that the application form and contract numbers are consistent, but it accepts values as matching when only their extracted digit sequences are equal. In a document pre-audit system for import/export licensing, this can let materially different contract identifiers pass review, enabling incorrect approvals, document mix-ups, or deliberate evasion of controls tied to exact contract references.

Context-Inappropriate Capability

High

• Confidence: 98% confidence
• Finding: This module goes far beyond dependency checking by automatically installing system packages, package managers, and executing shell/PowerShell commands with elevated privileges. In the context of a document pre-audit skill, this creates an unnecessary remote code execution and environment-modification surface, especially because some install paths download and run remote scripts.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The skill claims to perform document extraction and audit, but this file provisions the host by installing runtimes, OCR tools, package managers, and Python libraries. That mismatch is dangerous because users may grant trust appropriate for document processing while the code performs privileged system changes unrelated to core business logic.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The code actively retrieves model configuration and provider credentials from a runtime API and other ambient sources, expanding the trust boundary beyond what the skill description discloses. In a document pre-audit skill that processes potentially sensitive trade/license documents, this creates an unexpected outbound credential and configuration acquisition path that could route data to an unintended remote model provider or expose secrets through overbroad runtime access.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The skill sends prompts and document-derived data to a remote chat completion API via an external curl subprocess. Because this skill handles import/export license documents containing commercial and potentially regulated information, undisclosed outbound transmission to an LLM endpoint is a real data-exfiltration and compliance risk, even if implemented without malicious intent.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The code persists decrypted provider configuration by re-encrypting it with a hardcoded default key fallback, storing recoverable API credentials in settings.json. This is not strong protection because anyone with code access can derive the default key, and the behavior is not reflected in the skill description, increasing the chance that operators unknowingly store secrets on disk.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The code builds a Python program as a string and interpolates the untrusted pdfPath directly into that code, then executes it via `python3 -c`. A crafted file path containing quotes or Python syntax can break out of the string literal and achieve arbitrary code execution; additionally, invoking external tools like `python3` and `pdftoppm` on attacker-controlled files increases the attack surface for command/tool exploitation and denial of service.

Vague Triggers

High

• Confidence: 88% confidence
• Finding: The trigger words are very broad and overlap with ordinary conversation, making accidental activation more likely. In this skill's context, accidental activation is more dangerous because invocation can lead to file processing, archive extraction, report generation, network use, and possibly host modification through dependency installation.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The business-detail rule uses highly subjective criteria such as '大致相同，视为一致' and allows dynamic interpretation of product grouping, units, pricing basis, and tolerance logic. In a document pre-audit system for import/export licensing, this can lead to inconsistent or bypassable approvals, where materially different goods or values are incorrectly treated as matching and noncompliant applications may pass review.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger word "许可证" is broad enough to match ordinary conversation about permits or licensing, which can cause the skill to activate outside the user's intended workflow. In a document-processing skill that prompts users to upload folders or archives, unintended activation increases the chance of confusing users into sharing sensitive business documents or invoking processing in the wrong context.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: This file constructs a prompt containing raw document contents and sends it to the LLM without any visible warning, consent flow, or confidentiality notice. Because the skill processes trade-license documents and related commercial paperwork, the context makes this more dangerous than generic text processing: exposure could leak regulated business data, partner details, and transaction amounts to third parties.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The main entrypoint automatically installs missing dependencies without user confirmation, which causes unexpected system modification and potential privileged execution. In a skill meant for document review, silent package installation is especially risky because users do not reasonably expect host changes when processing files.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code downloads and executes the Homebrew installer directly from a remote URL with no integrity verification and no confirmation. This is effectively remote code execution on the host, and compromise of the upstream source, network path, or trust assumptions could lead to full system takeover.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The code invokes a PowerShell one-liner that downloads and executes the Chocolatey install script without user confirmation or integrity validation. On Windows this grants a remote script substantial control over the host and can lead to arbitrary code execution and persistent system modification.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly instructs the assistant to read the generated Markdown report and post it verbatim into chat. Because the report contains extracted data from uploaded import/export license materials, this can expose sensitive commercial, personal, or regulated document contents to chat participants, logs, integrations, and platform retention systems.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.exposed_secret_literal

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/utils/check-deps.js:98

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/utils/extract-archive.js:53

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/utils/llm-client.js:523

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/utils/pdf-ocr.js:20

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: src/utils/llm-client.js:26

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: src/utils/llm-client.js:331