Security audit
Security checks for vulnerabilities and agentic risk
The skill is transparent about operating Kingdee, but it can change or delete ERP data and includes an unsafe remote CLI installer path, so it should be reviewed before use.
Install only if you are comfortable granting an agent mediated access to Kingdee business data. Install the oo CLI through a verified, user-controlled process rather than letting an agent run the pipe-to-shell commands, connect a least-privilege Kingdee account, and require explicit review of every write, delete, or proxy payload before execution.
Referenced artifact was not completely inspected
3. Read [references/proxy-reference.md](references/proxy-reference.md). Fetch the selected operation's official detail first, then only the request fields, resp
Referenced artifact was not completely inspected
3. Read [references/proxy-reference.md](references/proxy-reference.md). Fetch the selected operation's official detail first, then only the request fields, resp
The skill includes a one-line installer that downloads a remote script and pipes it directly to a shell, which creates a classic supply-chain and remote code execution risk. If the remote host, transport, or script content is compromised, an agent or user following this instruction could execute arbitrary code with local privileges.
oo: command not found — install the oo CLI (other platforms: https://cli.oomol.com/install-guide.md):
curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux
The trigger text instructs the agent to use this skill for any Kingdee-related request, including reads, writes, and deletions, without meaningful scoping or preconditions. That broad routing increases the chance the skill is invoked in contexts where a narrower, safer workflow should apply, amplifying the risk of unintended state-changing operations.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
| Response fields | `/apiinfoparam/apiinfo/{apiInfoId}/paramfield/res` | Interpret an unfamiliar result |
| Examples | `/apiinfoparam/apiinfo/{apiInfoId}/paramjson` | Inspect request/response shapes when needed |
These are documentation endpoints, not enterprise execution endpoints. Read them with a public HTTP tool or curl without Cookie, Authorization or application credentials. Check both HTTP status and the JSON `result` flag. Fields are in `dataList`; examples are in `data.requestJson` and `data.responseJson` and may themselves be JSON strings.
Walk parameter-tree `children` recursively, keeping full paths and case. Interpret `isMust`, `fieldType`, `defaultValue` and `description` together: conditional requirements and example strings such as `"false"` are not unconditional defaults. An empty response-field tree does not prove an empty business response; consult the example.
Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
The CLI proxy envelope is `{ "data": { "status": ..., "headers": ..., "data": ... }, "meta": { "executionId": ... } }`. Read HTTP status from `response.data.status`, the Kingdee payload from `response.data.data`, and the trace ID from `response.meta.executionId`. This envelope is based on the connector/CLI contract; no real enterprise request was used during skill authoring.
| Kingdee payload | Interpretation |
| -------------------------------- | ------------------------------------------------------------------------------------------------------------------ |
| Ordinary business result | Check `Result.ResponseStatus.IsSuccess`; inspect `Errors`, error codes and messages |
| Report result | Check its documented status, commonly `Result.IsSuccess`; preserve Rows/RowCount only if returned |
No suspicious patterns detected.