T09 · Insecure Skill Coding Practices
Error
- Location
scripts/query_tracking.py:45- Finding
Caller-Controlled API Endpoint Exposes Shipment and Credential-Derived Data
- Content
View full analysis
- Remediation
View remediation
Security audit
批量快递查询API-快递鸟
Security checks for vulnerabilities and agentic risk
Overview
This shipment-tracking skill is coherent, but it needs review because its script can send tracking numbers and credential-derived request data to a caller-selected URL.
Review before installing. Use it only if you are comfortable sending shipment tracking numbers to Kdniao, do not pass --api-url unless you have independently verified the destination, and prefer patching or configuring the tool to allow only the official provider endpoint. Store real API credentials securely and do not reuse the sample values from the documentation.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (7)
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill documentation does not clearly disclose that tracking numbers and API credentials are used in requests to a third-party service. This creates a transparency and privacy risk because users or operators may provide shipment identifiers without understanding that the data leaves the local environment and is transmitted to Kdniao.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
L019 将技能触发描述为“查询快递物流、追踪运单、查看配送状态等需求”，其中“等需求”使边界不清晰，也没有列出明确触发短语或排除条件。对于 markdown 技能说明，这种宽泛表述可能导致在相近但并非明确要调用该技能的场景中被误触发。
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 91% confidence
- Finding
The skill explicitly depends on transmitting tracking queries to an external endpoint, which means user-supplied tracking numbers and authenticated requests leave the local environment. In this context, external transmission is expected for the feature, but it is still security-relevant because it exposes potentially sensitive shipment metadata to a third party and should be clearly disclosed and controlled.
- Content
md - 不同快递公司的查询结果格式可能略有差异 - 建议在查询前提醒用户确认运单号准确性 - API使用默认正式环境地址：`https://api.kdniao.com/api/dist`
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python CHARSET = 'UTF-8' # 默认正式环境API地址 DEFAULT_API_URL = 'https://api.kdniao.com/api/dist' # 接口类型配置 INTERFACE_TYPE = {
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 73% confidence
- Finding
该技能的标题、说明、步骤和注意事项全部以中文编写，未向用户提供语言选择，也未说明这是面向特定中文场景或地区的受限技能。按自然语言政策要求，若技能强制特定语言而无用户选择或合理限定，可能构成语言/locale 策略问题。
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file contains natural-language descriptions in Chinese in the module docstring, and the user-facing CLI description/help text is also Chinese. Under the policy, forcing a specific language without user opt-in can be a locale-policy violation unless the constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The script prints user-facing errors and command-line help in Chinese only, which imposes a language choice on users. The file does not indicate that this is a region-specific tool or provide any mechanism to select another language.
- Content