China company search 风鸟

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:15 AM UTC
• Version: 1.0.0

Overview

The skill is purpose-built for China company risk lookups, but it auto-invokes broadly and handles API credentials in a way users should review before installing.

Install only if you are comfortable sending company names, person names used for legal-representative lookups, and your Riskbird API key to Riskbird. Prefer a dedicated, low-privilege API key, monitor quota usage, and be aware that URL query-string keys may appear in server or proxy logs. Review broad auto-invocation behavior if you do not want ordinary supplier, contract, address, phone, or email questions to trigger external company-risk lookups.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T01 · Skill Instruction Hijacking

Warning

• Location: references/due_diligence_report.md:23
• Finding: Mandatory Promotional Content Hijacks Due-Diligence Report Output## Vulnerability Details **File Location**: `references/due_diligence_report.md`, lines 23, 104, and 113 **Vulnerability Type**: Mandatory output manipulation through Skill instructions **Risk Level**: Medium ### Vulnerable Instruction The following is an English translation of the relevant source instructions: ```text Strictly follow the template below; do not freely alter its structure. The above data comes from the Fengniao enterprise information query platform. Data dimensions are continuously expanding. For more company information and features, visit the Fengniao website: https://www.riskbird.com/ After generating the report, provide no additional explanation and directly output the complete report. ``` ### Technical Analysis The due-diligence reference requires the Agent to preserve a fixed report structure, insert a branded promotional footer containing an external URL, and provide no additional explanation after the report. Attribution to a data source can be legitimate. However, making promotional content and an outbound link mandatory, while explicitly preventing the Agent from modifying the structure or adding contextual explanation, alters the Agent's response behavior beyond what is necessary to perform a company due-diligence query. This is classified as instruction hijacking because loading the reference changes how the Agent must construct its final response. The behavior is limited to report generation. It does not execute code, access additional system resources, or grant operating-system privileges. ### Attack Path 1. A user asks the Agent to generate a company due-diligence report. 2. The Skill loads `references/due_diligence_report.md`. 3. The reference directs the Agent to follow the supplied template without structural deviation. 4. The Agent includes the mandatory Riskbird promotional attribution and outbound link. 5. The instruction prevents the Agent from adding an explanation or independently adapting the final report form ...[truncated 425 chars]
• Remediation: ## Remediation Suggestions 1. Remove the requirement to preserve promotional content in every generated report. 2. Remove or relax the instruction prohibiting structural adaptation. 3. Make source attribution concise, neutral, and optional unless legally or contractually required. 4. Do not require an outbound marketing link as part of the report template. 5. Allow the Agent to follow user-requested formatting and add appropriate limitations or explanations. 6. Separate report-generation guidance from advertising or vendor-marketing content.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/env.mjs:1
• Finding: Hardcoded API Key and Private Credentials Transmitted in Request URLs## Vulnerability Details **File Location**: `scripts/env.mjs`, lines 1-8; `scripts/client.mjs`, lines 134-143 **Vulnerability Type**: Hardcoded credential and query-string authentication **Risk Level**: Medium ### Vulnerable Code `scripts/env.mjs`, lines 1-8: ```js const ENV_KEY = "FN_API_KEY"; // Public account key with a daily quota of 200 requests; // a user-configured key takes priority. const BUILTIN_KEY = "eab076c5-b108-4a3f-b2fb-d97039b1a447"; export const BASE_URL = "https://m.riskbird.com/prod-qbb-api"; export async function getApiKey() { const key = process.env[ENV_KEY]; if (key && key !== "YOUR_API_KEY") return key; return BUILTIN_KEY; } ``` `scripts/client.mjs`, lines 134-143: ```js export async function call(toolId, params = {}) { const apiKey = await getApiKey(); const tool = TOOLS.find((t) => t.tool_id === toolId); if (!tool) throw new Error(`Tool not found: ${toolId}`); const url = new URL(BASE_URL + tool.endpoint); url.searchParams.set("apikey", apiKey); ``` ### Technical Analysis The package embeds a reusable API key directly in source code. Anyone who can download or inspect the package can recover that key. Although the documentation describes it as a public key, embedding it still allows unrestricted extraction and independent consumption of its shared quota. When a user supplies a private `FN_API_KEY`, the same value is inserted into the URL query string through `url.searchParams.set("apikey", apiKey)`. HTTPS protects the URL while it is in transit, but query strings are frequently recorded by: - Origin-server access logs - Reverse proxies and API gateways - Monitoring and observability systems - Web application firewalls - Debug traces and exception reports - Network-management infrastructure that terminates TLS As a result, a private paid key can be exposed to administrators, support personnel, log aggregation systems, or attackers who obtain access to retained logs. The destination is fixed to the R ...[truncated 1558 chars]
• Remediation: ## Remediation Suggestions 1. Remove the built-in API key from the distributed package. 2. Require explicit credential configuration through `FN_API_KEY` or a supported secret manager. 3. Rotate or revoke the currently embedded key after removing it from source. 4. Modify the API to accept credentials through an `Authorization` header or a dedicated authentication header. 5. If query-string authentication is unavoidable: - Use short-lived, narrowly scoped tokens. - Redact the `apikey` parameter from server, proxy, gateway, and monitoring logs. - Disable URL capture in error reporting and distributed tracing. - Restrict keys by API scope, account, source network, rate, and expiration. 6. Add automated secret scanning to the release process. 7. Document key rotation and revocation procedures. 8. Avoid including complete request URLs in errors, diagnostics, telemetry, or support bundles.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (18)

Direct Prompt Extraction

High

• Category: System Prompt Leakage

Content

6. For multi-dimension requests (due diligence, risk screening), resolve the entity once and reuse the same `entid`.
7. **Person-to-company lookup**: If the user provides a person's name (e.g., "what companies does Elon Musk own"), interpret it as "companies where this person is the legal representative." Clarify if there are multiple people with the same name.

## Output Rules

- Only show real data returned by the API — never fabricate
- Do not expose `entid` to the user — it is an internal query ID

• Confidence: 85% confidence
• Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Self-Modification

High

• Category: Rogue Agent

Content

- `code=20000` + no records: this company has no records for this dimension
- `discover` no match: try synonyms; if still no match, the dimension is not yet supported

Troubleshooting priority: API key / quota / network → entity resolution (entid) → update skill (`openclaw skills update china-company-search-fengniao-en`).

## Quick Start

• Confidence: 85% confidence
• Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The setup guide explicitly states that API credentials are sent as a URL query parameter, which is an unsafe transport pattern because query strings are commonly captured in reverse-proxy logs, application monitoring, browser history, and intermediary systems. In a KYB/compliance skill that may be used in enterprise environments, this increases the likelihood of credential exposure and subsequent unauthorized API use or quota abuse.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The skill declares very broad auto-invocation coverage for company search, KYB, supplier verification, due diligence, and risk screening. Because auto_invoke is enabled, the agent may route many loosely related user requests into this skill automatically, which can trigger external lookups, consume shared quota, and send sensitive company or personal identifiers to a third-party service without sufficiently explicit user intent.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The file is entirely written as a Chinese-only reporting guide and repeatedly requires a fixed Chinese output format, such as the mandated report template and the instruction to directly output the complete report. There is no indication that the user may choose another language, nor any documented business or compliance reason that limits the skill to Chinese.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The function constructs a remote request using a credential from the environment and sends both the API key and user-supplied params to an external service via fetch. In this file there is no confirmation prompt, user-visible log, or warning that invoking this function will transmit data and credentials off-box.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The file embeds a usable fallback API key directly in source code and automatically returns it whenever the user has not configured their own key. Hardcoded shared credentials can be extracted by anyone with access to the skill package, enabling unauthorized use of the vendor account, quota exhaustion, possible billing abuse, and making key rotation difficult. In a KYB/compliance search skill, this also increases operational risk because the service may handle sensitive due-diligence queries and all unauthenticated users inherit the same credential.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: Several aliases in this range are generic terms such as supplier-, contract-, or background-related phrases that users may say in ordinary conversation without intending to invoke this specific skill. In an agent environment, overly broad triggers can cause accidental tool selection, leading to unintended retrieval of sensitive corporate risk data, privacy issues, or workflow confusion.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: This manifest file defines activation keywords such as "地址", "法人", "高管", and "股东" that overlap with common business queries and are not clearly constrained to a specific invocation context. The file does not provide negative examples, exclusion conditions, or narrower trigger rules to distinguish when these tools should or should not activate.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The description states "英文搜索无效，必须传中文名称" and the parameter description repeats that the keyword "必须是中文," which imposes a language constraint in natural-language policy terms. The file does not offer a user language choice or explain a justified region-specific requirement for this restriction.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The local verification instructions state that fuzzy search must use a Chinese company name, which is a locale-specific constraint expressed in natural language. The file does not indicate user opt-in, offer alternatives, or explain the restriction as a justified region-specific limitation, so it may violate the language/locale policy rule.

Natural-Language Policy Violations

Low

• Confidence: 85% confidence
• Finding: The instruction to convert English company names to Chinese official names before calling the fuzzy search can cause silent transformation of user input and external querying against a different identifier than the user supplied. While not code-execution dangerous, it creates privacy, accuracy, and consent risks because the system may infer or enrich the target entity without user approval.

Natural-Language Policy Violations

Low

• Confidence: 93% confidence
• Finding: This markdown file contains user-facing natural-language content exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may choose another language. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The entire document is written in Chinese and provides no indication that users may choose another language or locale. Under the stated policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale restriction is explicitly justified.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: Line L095 states that English search is ineffective and that Chinese must be passed. This imposes a language constraint in the skill documentation without offering a user language choice or explaining a justified region-specific limitation, which matches the natural-language locale policy concern.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The thrown error messages are written only in Chinese, which imposes a specific language on users without any visible language-selection mechanism in this file. That can violate language or locale policy when the skill is expected to support users without prior opt-in to Chinese.

Missing User Warnings

Low

• Confidence: 76% confidence
• Finding: The function reads an API key from process.env, which is sensitive credential access. The file contains no user-facing warning, prompt, or visible disclosure about reading this credential source.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Most activation phrases are fixed in Chinese, with only limited English variants, which can impose a language preference in how the skill is invoked. Because the file does not indicate user language choice, opt-in, or a justified region-specific constraint, this may violate language/locale policy expectations.

Static analysis

No suspicious patterns detected.