Security audit

Juhe Telephone Verify

Security checks for vulnerabilities and agentic risk

Overview

The skill performs the advertised phone-name-ID verification, but it under-discloses third-party sharing and exposes highly sensitive identity data in URLs and terminal output.

Review before installing. Use this only for lawful, consented telecom identity verification, and assume the name, ID card number, phone number, and Juhe API key may appear in request URLs or terminal logs. Prefer a version that uses POST bodies, masks output by default, and asks for explicit confirmation before sending identity data to Juhe.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/telephone_verify.py:64
Finding: Sensitive credentials and identity data exposed in HTTP GET query parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/telephone_verify.py:198
Finding: Full personal identity information printed to standard output
Content: View full analysis
Remediation: View remediation
str: return value[:3] + "****" + value[-4:] if len(value) >= 7 else "****" def mask_idcard(value: str) -> str: return value[:3] + "*" * max(0, len(value) - 7) + value[-4:] if len(value) >= 7 else "****" print(f"Name: {args.name[:1]}**") print(f"Identity card: {mask_idcard(args.idcard)}") print(f"Mobile: {mask_mobile(args.mobile)}") ``` Additional controls should include: 1. Require an explicit, clearly documented opt-in option before displaying unmasked values. 2. Apply the same redaction rules to both human-readable and JSON output. 3. Warn users not to pass sensitive values through environments where command invocations or output are persistently logged. 4. Restrict access to any logs that may already contain verification output. 5. Establish short retention periods and secure deletion procedures for identity-verification logs. 6. Add automated tests confirming that full identity card numbers and mobile numbers never appear in default output. ]]>

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (23)

Tainted flow: 'params' from os.getenv (line 65, credential/environment) → requests.get (network output)

Critical

Category: Data Flow
Confidence: 90% confidence
Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
Content: Scanner excerpt · scripts/telephone_verify.py (reported line 74)May include surrounding context.
python
try: # 发起请求 response = requests.get(api_url, params=params, timeout=10) if response.status_code == 200: result = response.json()

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This skill handles extremely sensitive personal data—full name, national ID number, and mobile phone number—and the documentation does not clearly warn that these identifiers will be transmitted to an external verification service. The lack of prominent disclosure and consent language materially increases the risk of privacy violations, unauthorized third-party sharing, and noncompliance with data protection obligations.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script sends highly sensitive personal data—real name, ID card number, and mobile number—to a third-party service without any explicit user-facing notice or confirmation at runtime. In the context of a verification skill, third-party transmission is functionally necessary, but failing to clearly disclose that external sharing occurs creates significant privacy, compliance, and consent risk for users handling Chinese identity data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script prints the full name, full ID card number, and full mobile number directly to stdout. Terminal output is often captured in shell history, logs, CI traces, agent transcripts, or screen recordings, so exposing raw identifiers materially increases the chance of identity-data leakage beyond the intended verification result.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents use of an API key, references local configuration files, and describes a networked verification script, but it does not declare an explicit tool scope such as allowed tools or permissions. That mismatch can cause the agent to invoke file, environment, or network capabilities without transparent constraints, increasing the chance of unintended secret access or external data transmission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The direct invocation guidance is broad and encourages triggering the skill whenever a user provides name, ID card, and phone number, without requiring confirmation, authority checks, or a privacy warning. In practice, this can lead to accidental transmission of highly sensitive PII to a third-party service based on ambiguous or insufficiently authorized user requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The document instructs transmission of highly sensitive personal data including full name, Chinese ID card number, and mobile number to a third-party verification API, but provides no warning about privacy, consent, retention, legal basis, or secure handling obligations. In the context of a real-name authentication skill, this increases the chance that integrators will collect and forward regulated personal data without adequate user notice or safeguards, creating significant privacy and compliance risk.
Content: No source excerpt is available for this finding.

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 29)May include surrounding context.
md
## 返回参数 | 名称 | 类型 | 说明 | | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | error_code | int | 状态码 | | reason | string | 状态提示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 31)May include surrounding context.
md
| 名称 | 类型 | 说明 | | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | error_code | int | 状态码 | | reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 32)May include surrounding context.
md
| 名称 | 类型 | 说明 | | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | error_code | int | 状态码 | | reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 33)May include surrounding context.
md
| 名称 | 类型 | 说明 | | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | error_code | int | 状态码 | | reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 34)May include surrounding context.
md
| 名称 | 类型 | 说明 | | ---------- | ---------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | error_code | int | 状态码 | | reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 35)May include surrounding context.
md
| reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 41)May include surrounding context.
md
| reason | string | 状态提示 | | result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 36)May include surrounding context.
md
| result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 42)May include surrounding context.
md
| result | jsonObject | 返回结果 | | res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 37)May include surrounding context.
md
| res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 43)May include surrounding context.
md
| res | int | 核验结果 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 38)May include surrounding context.
md
| resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 | | resmsg | string | 核验结果描述 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 44)May include surrounding context.
md
| resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 | | resmsg | string | 核验结果描述 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 39)May include surrounding context.
md
| type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 45)May include surrounding context.
md
| type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 |

Whitespace Padding

Medium

Category: Prompt Injection
Confidence: 70% confidence
Finding: Large whitespace padding was detected (a block of blank lines or a long run of spaces). This can push injected instructions below or to the right of the visible area so a human reviewer never sees them while the agent still reads them. Manual review of the hidden content is recommended.
Content: Scanner excerpt · references/api.md (reported line 40)May include surrounding context.
md
| orderid | string | 聚合订单号，请求参数showid=1时显示 | | province | string | 手机号归属省份，请求参数province=1时，显示 | | city | string | 手机号归属城市，请求参数province=1时显示 | | rescode | string | 匹配详情码，请求参数detail=1时显示（说明 1：三要素核验一致 2：三要素核验不一致0 | | resmsg | string | 核验结果描述 | | type | string | 手机运营商，请求参数type=1时显示 | | orderid | string | 聚合订单号，请求参数showid=1时显示 |