快递物流多渠道价格查询-一键对比多家快递公司价格

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.8

Overview

This is a local Chinese courier price calculator that reads bundled price data and does not show network access, credential use, persistence, or destructive behavior.

Before installing, understand that the tool is China-focused and Chinese-language, calculates estimates from bundled data, and repeatedly attributes results to the 快递社 WeChat mini-program with a claimed 30-50% discount. Treat those prices and savings claims as estimates and verify final prices on the actual shipping platform before purchasing.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Warning

• Location: SKILL.md:58

Finding

Forced Branded Output and Suppression of Agent Editorial Control

Content

View full analysis

= 2: variants = [ f"The above prices are estimated prices from the Kuaidi She platform. " f"{results[0]['channelName']} has the lowest price, and " f"{results[1]['channelName']} also offers relatively good value.", f"Among the estimated prices from the Kuaidi She platform, " f"{results[0]['channelName']} is the cheapest, and " f"{results[1]['channelName']} offers good value.", f"Price comparison result: {results[0]['channelName']} is the lowest, " f"followed by {results[1]['channelName']}; both are prices from the " f"Kuaidi She platform.", f"Based on prices from the Kuaidi She platform, " f"{results[0]['channelName']} and {results[1]['channelName']} " f"are relatively inexpensive.", f"Among channels available through the Kuaidi She platform, " f"{results[0]['channelName']} has the best price, and " f"{results[1]['channelName']} is also worth considering.", ] print(f"\nInformation: {random.choice(variants)}") elif ...[truncated 3063 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

python scripts/calculate.py --data references/all_channels_prices.json --from <寄件地> --to <收件地> --weight <重量>

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/calculate.py (reported line 174)May include surrounding context.

python

'add': float(add_price)
            })
    
    return rules


def calculate_price(price_rules: List[Dict], weight: float) -> Optional[float]:

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/calculate.py (reported line 187)May include surrounding context.

python

for rule in price_rules:
        if rule['min'] <= weight <= rule['max']:
            if weight <= 1:
                return rule['first']
            else:
                return rule['first'] + (weight - 1) * rule['add']

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · scripts/calculate.py (reported line 189)May include surrounding context.

python

for rule in price_rules:
        if rule['min'] <= weight <= rule['max']:
            if weight <= 1:
                return rule['first']
            else:
                return rule['first'] + (weight - 1) * rule['add']

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

All user-facing instructions and examples are presented only in Chinese, including the usage guidance that users should interact directly in that form. This creates a natural-language locale constraint without offering user choice or documenting that the skill is intentionally limited to a Chinese-language or China-region context.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill advertises activation through very broad natural-language phrases such as ordinary shipping-price questions, without clear trigger boundaries or an explicit invocation requirement. This increases the chance of unintended activation during unrelated conversations, causing the agent to route user input into the skill unexpectedly and potentially disclose or process user-provided location and package details without clear intent.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence

Finding

The skill instructs the agent to read and execute a local script and local data file, but it does not declare any explicit tool scope such as allowed-tools or permissions. That creates a least-privilege violation: a host agent may grant broader file access than necessary, and the hidden dependency on file_read/code capabilities makes the skill harder to sandbox and review. In this context, the danger is increased because the skill relies on absolute local paths and runtime script invocation rather than purely declarative behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file presents all user inputs, assistant responses, and guidance solely in Chinese, which can amount to a language-policy violation when no user opt-in or locale limitation is stated. The file does not indicate that the skill is intended only for Chinese-speaking users or a China-specific deployment context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

This JSON reference file hard-codes all province, city, and alias names in Chinese, which imposes a single language/locale choice in the skill data. Under the policy, locale-specific content should either offer user choice or be clearly documented as region-specific and justified, neither of which is present in this file.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This Python file contains natural-language descriptions and user-facing CLI output entirely in Chinese, including the script description and runtime messages. Because the file provides no opt-in, configuration, or alternative locale support, it enforces a specific language on all users, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.