物流延迟检测 & 安抚短信

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:31 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a real logistics/SMS workflow, but it needs review because it can auto-install code, process and store customer data, and send bulk SMS without the documented confirmation step.

Review this skill before installing. Use dry-run first, avoid running it where automatic package installation can occur, keep SMS credentials in a protected secret store or environment, and do not use send mode until recipients and message text have been separately reviewed. Treat generated JSON and HTML reports as sensitive customer data.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: scripts/logistics_checker.py:19

Finding

Automatic Installation of an Unpinned Dependency from a Third-Party Mirror

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/sms_sender.py:276

Finding

Stored HTML Injection in Generated Logistics and SMS Reports

Content

View full analysis

{d["icon"]} {d["name"]}' sms_preview = "" if msg_info.get("message"): sms_preview = f"""

SMS preview ({msg_info.get('char_count', 0)} characters):

{msg_info.get('message', '')}

""" order_rows += f""" {o.get('order_id', '')} {o.get('customer_name', '-')} {o.get('tracking_number', '')} {tracking.get('status', '-')} {tracking.get('carrier', '-')} {delay_tags if delay_tags else 'No exception'} {status_text} {sms_preview} """ ``` The original source directly interpolates these values into the report; the labels above are rendered in English for reporting clarity. ### Technical Analysis The report generator inserts order data, logistics-provider response data, delay metadata, and generated SMS content directly into HTML without contextual escaping. Potentially untrusted fields include: - `order_id` - `customer_name` - `tracking_number` - Logistics status and carrier name - Delay name, icon, and severity - Generated message content - Shop configuration incorporated into message content CSV data can be attacker-controlled, while carrier and tracking fields can also originate from a remote API. A value containing HTML markup, such as an image element with an event handler, is written unchanged into the generated report. Although the report is a local file, script execution can still occur when an operator opens it in a browser. Browser res ...[truncated 1177 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/logistics_checker.py:389

Finding

Plaintext Persistence of Customer Personal and Logistics Data

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/order_processor.py:120

Finding

Documented Pre-Send Confirmation Is Not Implemented

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (21)

Tainted flow: 'headers' from os.environ.get (line 155, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/logistics_checker.py (reported line 162)May include surrounding context.

python

try:
        url = f"{UAPI_BASE_URL}?{urlencode(params)}"
        resp = requests.get(url, headers=headers, timeout=15)
        
        if resp.status_code == 200:
            data = resp.json()

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

代码与描述部分匹配于“物流查询+延迟检测”这一子集：支持CSV读取、单号查询、UAPI物流轨迹查询，以及发货超时/运输停滞/派送异常/预计超时/无物流信息等规则检测。但描述中的关键后半部分能力——AI生成安抚话术、短信发送给客户、云短信通道集成、dry-run预览——在代码中完全缺失。现有 --validate 只是校验CSV格式，不是发送前预览。因此该技能的声明明显超出了代码实际行为，属于描述与实现不一致。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The declared description presents a broader end-to-end logistics delay detection skill: ingesting order data (CSV/manual waybill input), querying shipment tracking, detecting multiple delay conditions, generating AI reassurance copy, and sending SMS. The supplied code only implements the downstream messaging/reporting portion. It reads an input JSON file that is explicitly described as output from a separate logistics checker, uses templates/rules to generate SMS text, optionally sends via Alibaba or Tencent SMS SDKs, and generates an HTML preview. There is no code for CSV parsing, manual waybill entry, external logistics API querying, or actual delay detection from raw tracking events in this chunk. Because key declared capabilities are absent and the actual code is narrower than the declared end-to-end behavior, this is a description-behavior mismatch.

Content

No source excerpt is available for this finding.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The script reads sensitive configuration from environment variables (UAPI_API_KEY) but the finding indicates this capability is not declared in permissions metadata. Undeclared access to environment secrets weakens sandboxing and user trust because the skill can consume credentials without transparent permission coverage.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 97% confidence

Finding

The script executes a shell command to install dependencies automatically when requests is missing. Even though the interpolated executable path is not directly user-controlled here, invoking os.system() for package installation expands the attack surface, can execute unexpected code during install, and performs side effects without explicit user approval.

Content

Scanner excerpt · scripts/logistics_checker.py (reported line 23)May include surrounding context.

python

import requests
except ImportError:
    print("[SETUP] 安装依赖: pip install requests")
    os.system(f"{sys.executable} -m pip install requests -i https://pypi.tuna.tsinghua.edu.cn/simple/ --trusted-host pypi.tuna.tsinghua.edu.cn")
    import requests

# ============ 配置 ============

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The trigger list is broad enough that normal logistics- or delivery-related conversation could invoke the skill unexpectedly. Because the skill is designed to process order data, query external services, and potentially send customer-facing SMS, accidental activation increases the risk of unintended data handling or downstream actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill handles sensitive customer data such as names, phone numbers, tracking numbers, and order details, and it contemplates bulk outbound SMS. Without explicit warnings, consent expectations, data-handling guidance, and operational safeguards, users may process personal data improperly or send messages in violation of privacy, telecom, or anti-spam requirements.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The document instructs users to configure third-party SMS providers and pass full message content through templated variables, but it does not warn that customer names, order IDs, tracking numbers, phone numbers, and delay details may be disclosed to external vendors. In this logistics-care context, those fields are likely to contain personal and transactional data, creating privacy, compliance, and data-sharing risks if operators are not explicitly guided to minimize and protect transmitted content.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The JSON configuration example encourages storing cloud access credentials in a local file without any warning about filesystem permissions, exclusion from version control, or secret-management practices. If copied into a repo, shared workspace, backup, or support bundle, these secrets could be exposed and allow unauthorized use of the SMS account, message fraud, billing abuse, or broader cloud compromise depending on account scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Tencent Cloud credential example similarly presents persistent storage of secret_id and secret_key in JSON without secure-handling warnings. In a skill designed for operational messaging, these credentials could be attractive targets because compromise enables unauthorized SMS sending, cost abuse, impersonation of the business, and potential access to related cloud resources.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill auto-installs a Python package at runtime via a shell command, which is unrelated to its core logistics-checking function and introduces supply-chain and execution risk. A network-retrieved package can run arbitrary install-time code, and the user may not expect the script to modify the environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script installs dependencies automatically without explicit user confirmation, causing unexpected code execution and environment modification. In a skill that processes customer logistics data, silent setup actions are particularly risky because users may run it in trusted automation contexts where side effects are not anticipated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This file contains natural-language strings that force a specific language/locale for the skill experience, including the module docstring and CLI help text. Under the policy, language constraints should be optional or explicitly justified; here there is no opt-in or explanation that the skill is intended only for Chinese-speaking users.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/order_processor.py (reported line 24)May include surrounding context.

python

print(f"  {name}")
    print(f"{'='*60}")
    
    result = subprocess.run(cmd, capture_output=False, text=True)
    if result.returncode != 0:
        print(f"⚠️  步骤失败 (exit code: {result.returncode})")
        return False

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

脚本的自然语言内容、短信模板、HTML页面语言和手机号格式均固定为中文语境与中国大陆配置，如lang="zh-CN"和+86前缀，但没有提供语言或地区选择机制。按规则，这属于未获用户选择即强制特定语言/locale的策略问题。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

In send mode, the skill transmits customer phone numbers and personalized message contents to Alibaba Cloud or Tencent Cloud SMS APIs without presenting an explicit risk notice or consent checkpoint. Because the skill is specifically designed for bulk customer communications, this expands third-party data exposure and can create privacy, regulatory, and misuse risks if operators are unaware of the transfer scope.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The script writes an HTML preview report and a JSON result file containing customer names, order IDs, tracking numbers, phone numbers, and message content to disk without any warning, minimization, or access protection. In an e-commerce logistics context, these artifacts can expose personally identifiable information to other local users, backups, logs, or accidental sharing, increasing privacy and compliance risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill title and all user-facing instructions are written in Chinese, and the described output includes automatically generated SMS copy, implying a fixed language/locale experience. The file does not offer user opt-in for language selection or explain that the skill is intentionally limited to a Chinese-speaking or China-market context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The file-level natural-language description is entirely in Chinese and presents the skill as operating in that language without any indication of user choice or opt-in. Under the policy, language constraints should either offer a language/locale choice or be explicitly justified as region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The top-level description and module docstring present the script as a logistics delay detection engine that queries tracking, applies rules, and outputs structured detection results. In practice, batch processing persists a JSON file containing customer names, phone numbers, tracking numbers, and tracking details, which is broader data handling than the narrow detection description suggests.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The module docstring at L004 and section comment at L074 describe AI or LLM-generated personalized messaging, implying model-driven generation. In practice, generate_message_ai at L076-L098 just selects a hardcoded template and formats variables, with no model invocation or external AI call.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.