Ship Position

• Outcome: Review
• Latest audit: Jul 23, 2026 · 1:25 AM UTC
• Version: 0.3.21

Overview

This appears to be a legitimate HiFleet integration, but it needs Review because it uses an API key for account, billing, console login, and contact-detail flows that are not fully reflected in its security claims.

Install only if you are comfortable giving this skill a HiFleet API key that can query account usage, create payment orders, manage subscriptions/invoices, open a console session, and retrieve contact details from charter records. Prefer environment variables over config.json, avoid putting API keys in URLs or logs, keep HIFLEET_API_BASE pointed only at a trusted HiFleet host, and require explicit confirmation before billing changes or bulk contact retrieval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (26)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill documents use of environment variables, local files, and network access, but does not declare permissions accordingly. This weakens least-privilege controls and can cause users or hosting platforms to underestimate the skill's ability to access secrets and make outbound requests. In this context, the undocumented capabilities matter because the skill handles an API key and can reach account, billing, and console endpoints in addition to data APIs.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared purpose emphasizes maritime intelligence, but the documented behavior extends into contact unlocking, enrichment, and opening a console session using the API key. This mismatch can mislead users and reviewers about what the skill can do, increasing the chance that sensitive actions are triggered under the guise of a data lookup skill. Because the skill also references billing and account workflows, the hidden breadth raises the risk of unauthorized access to account context or paid actions.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The manifest and introductory description present a shipping intelligence skill, but the file also describes signup, billing, invoicing, and console SSO flows. That scope expansion is security-relevant because it changes the trust boundary from read-only maritime data retrieval to account-management operations that may expose identity, usage, payment, or session information. Users invoking a vessel-data skill may not reasonably expect these additional behaviors.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The security section claims requests are limited to fixed-path, read-only vessel-data APIs, yet other documented sections include broader account and billing endpoints. This creates inaccurate security assurances and may cause operators to approve the skill under false assumptions about what data and actions it can access. Misrepresentation of network scope is particularly risky when an API key is the primary credential.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation states the skill performs only read-only requests, but elsewhere it describes registration, order creation, subscription changes, and payment-related workflows. That is a substantive security issue because reviewers and users may rely on the read-only claim when deciding whether to grant access to credentials or run the skill. State-changing financial/account actions materially increase risk compared with passive data retrieval.

Intent-Code Divergence

Medium

• Confidence: 84% confidence
• Finding: The security claim says requests are restricted to the HIFLEET API, but the destination is fully overrideable through HIFLEET_API_BASE. In environments where untrusted parties can influence environment variables, this can redirect requests—and any included api_key—to an attacker-controlled host, causing SSRF-like outbound access and credential leakage.

Vague Triggers

Medium

• Confidence: 70% confidence
• Finding: The trigger phrase "积分" is overly broad in a section that can access account balance, usage, billing, and payment workflows. Unlike generic content lookups, accidental activation here can expose account-related information or steer users into financial actions they did not intend to invoke. In this context, broad triggering is more dangerous because the skill spans sensitive account and billing functions.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill explicitly instructs the agent to retrieve plaintext contact details for one or all listed rows, but only mentions API-point consumption and not any privacy, authorization, or sensitive-data implications. In a maritime commercial context, owner/charterer contact details are likely non-public or access-controlled, so encouraging bulk retrieval without a clear warning or authorization check increases the risk of over-collection and misuse.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs sending row data and an API key to an external service but does not require any user-facing disclosure, consent, or data-minimization warning. This can cause operators or downstream agents to transmit vessel/cargo details and credentials off-platform without clear notice, increasing privacy and secret-handling risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill explicitly documents a capability to retrieve masked contact details on demand, but it does not require a clear user-facing warning that personally identifying or restricted contact information will be revealed. In a marketplace context, this creates a privacy and consent risk because an agent could expose contact data without the user fully հասկosing that masked information is being unmasked.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The tool provides a direct contact-unlock function that sends a record identifier to a remote API and returns contact details immediately, with no consent prompt, policy check, purpose validation, or masking of potentially sensitive personal/business contact data. In a CLI/agent context, this lowers the barrier to bulk or accidental disclosure of contact information and makes unauthorized retrieval easier if the skill is invoked by another automated component.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The batch mode reads IDs from a file, unlocks all matching contacts, and prints the results, enabling easy mass retrieval of contact details with no confirmation, throttling, or review step. In an agent skill, this is more dangerous because a single invocation can automate scraping or exfiltration of many contact records from prior search results.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly permits passing the API key in the query string (`?api_key=` or `?sk=`) without warning about exposure risks. Query parameters are commonly captured in browser history, intermediary logs, analytics systems, referrer headers, and shared debugging output, which can lead to credential leakage and unauthorized access to the user's account and usage data.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The documentation explicitly recommends storing the API key in a plaintext project config.json file without caveats. Secrets placed in source trees are commonly committed to version control, shared in archives, exposed through logs, backups, or local compromise, which can lead to unauthorized API use and account abuse.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The documentation instructs users to send the API key in the URL query string, which increases the chance the credential will be exposed through logs, browser history, reverse proxies, analytics, referrers, or shared diagnostics. In this skill context, the risk is real because API docs are often copied directly into tooling and scripts, propagating insecure credential handling into production use.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The skill instructs the agent to read and use HIFLEET_API_KEY to mint a console login session, but the activation guidance does not require an explicit user-facing confirmation before accessing stored credentials. In an agent setting, this can cause unintended use of a sensitive API key and creation of authenticated console links without sufficiently clear user consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly permits sending the API key as a query parameter, which is unsafe because query strings are commonly logged by servers, proxies, browser history, monitoring tools, and referrer headers. In this skill context, the API key protects access to maritime penalty data and may be reused across requests, so disclosure could enable unauthorized API use and data access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The documentation explicitly permits sending the API key in the URL query string, which is routinely logged by browsers, proxies, reverse proxies, server access logs, monitoring tools, and shared diagnostics. Even though HTTPS protects the request in transit, query parameters are more broadly exposed than headers, so this increases the chance of credential leakage and replay by anyone who gains access to those logs.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The example request shows `api_key` embedded directly in the query string, normalizing an unsafe usage pattern for downstream agents and developers. In an agent skill context, this is more dangerous because automated tooling may copy the example verbatim, causing secrets to be propagated into logs, traces, debugging output, and cached request metadata across multiple systems.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The Ship Position skill includes trigger phrases like '位置', '在哪', and 'where is', which are broad enough to match ordinary conversational queries unrelated to vessel tracking. In an agent-routing context, this can cause unintended skill invocation, leading to wrong-tool use, unnecessary API calls, or accidental exposure of maritime data in response to ambiguous prompts.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The Archive skill uses generic triggers such as '档案', '信息', 'owner', and 'manager', which are not specific to vessel-profile retrieval and may overlap with many unrelated requests. This increases the chance of misrouting user input into a vessel archive workflow, producing incorrect responses or unnecessary backend lookups.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The Port guide skill advertises triggers such as '港口', '港名', 'port', and 'port name', which are highly generic and can match many ordinary questions that are not requests for structured port-guide data. In a multi-skill agent, this can bias routing toward this skill and cause unintended data retrieval or incorrect tool selection.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The script sends the API key as a URL query parameter (`api_key=...`). Even over HTTPS, query strings are commonly exposed in client logs, shell history, proxy logs, monitoring tools, and server access logs, which increases the chance of credential leakage beyond the intended recipient. In this skill context, the script is explicitly a network client for a third-party API, so handling secrets safely is important and the issue is real rather than theoretical.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Endpoint

**`POST https://api.hifleet.com/openclaw/vessel/charter/enrich-row?api_key={密钥}`**

(Config: `charter_enrich_url` — same URL.)

• Confidence: 92% confidence
• Finding: https://api.hifleet.com/

External Transmission

Medium

• Category: Data Exfiltration

Content

| Item | Value |
|------|--------|
| `{base}` | `https://api.hifleet.com/openclaw/vessel/charter/liner` |
| Resolve | `hifleet_liner_api_base` -> `HIFLEET_LINER_API_BASE` -> default |
| Body | Empty (query only), unless gateway requires otherwise |
| `dataId` | Top-level **`id`** from schedule list row (not nested `senderInfoList.id`) |

• Confidence: 78% confidence
• Finding: https://api.hifleet.com/

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: FIRST_SETUP.md:68

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:298