Security audit

快递物流多渠道价格查询-一键对比多家快递公司价格

Security checks across malware telemetry and agentic risk

Overview

This skill is a courier price calculator that runs a bundled local script against bundled price data, with no evidence of credential access, exfiltration, persistence, or destructive behavior.

Install only if you are comfortable with the skill running its bundled Python calculator and reading its bundled courier price database. Treat the prices as estimates from the named provider and verify final shipping costs before purchase.

SkillSpector

By NVIDIA

Vulnerability Patterns

MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill invokes a local Python script and references a local JSON file path, which indicates code/file-read capability despite declaring no permissions. This creates a trust and sandboxing issue: the runtime may permit filesystem access that users and reviewers are not informed about, and direct execution of local scripts increases risk if the script or referenced files are modified or contain unsafe logic.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.