Security audit

Logistics Manager

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly aligned with logistics management, but it includes broad unauthenticated record, notification, CRM-sync, file, and subprocess capabilities that need review before use.

Install only in a controlled local environment, not as a public-facing API, unless authentication and role checks are added. Review and constrain the OKKI integration paths, pass a minimal environment to subprocesses, gate live sync during tests, and restrict BOL read/delete helpers to the archive directory. VirusTotal was pending and was not used as a negative signal.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill documentation references environment-variable configuration but does not declare corresponding permissions/capabilities. This creates a transparency and governance problem: operators may approve or deploy the skill without understanding that it accesses runtime secrets or configuration, which can enable unintended data exposure or misuse when combined with other functionality.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The declared skill scope is logistics management, but the detected behavior extends to public HTTP APIs, CRUD operations, file upload/archive handling, and automatic/manual notification sending. This scope expansion is dangerous because reviewers and users may authorize a seemingly narrow document/logistics skill while it actually exposes network-facing and state-changing capabilities that can modify records, store files, and trigger outbound communications.

Description-Behavior Mismatch

Medium

Confidence: 90% confidence
Finding: The route adds outbound notification/email functionality that is not declared in the skill description, creating an undeclared external communication channel. In a logistics skill handling customer and shipment data, this can be abused to send messages to arbitrary recipients or trigger unintended data disclosure and external actions.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The getBol function accepts an arbitrary filePath and reads it directly without verifying that the target resides under the bill-of-lading archive directory. If an attacker can influence this argument, they can read any file accessible to the process, which exceeds the module's stated purpose of retrieving archived BOL files and can expose credentials, keys, or other sensitive business documents.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The deleteBol function deletes any path provided by the caller and does not ensure that the file is actually an archived bill-of-lading. In a logistics automation context, this can be abused to remove arbitrary application files, data, or configuration, causing data loss, service disruption, or destruction of audit-critical shipping records.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The test script hard-codes and invokes an external Python CLI from another workspace via an absolute path, which expands the skill's effective execution boundary beyond the logistics repository. This creates cross-workspace command execution and data access risk: running the test can trigger code outside the reviewed skill, with whatever behavior that external script currently contains.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The spawned Python process receives the full parent process environment, which may include unrelated secrets such as API keys, tokens, cloud credentials, or proxy settings. Because the script also executes external code, this unnecessarily broad environment inheritance can leak sensitive data to child processes or downstream systems.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The fallback path writes a Python script containing potentially sensitive logistics and customer data into /tmp, which may be readable by other local users depending on system configuration and file permissions. The script is only deleted after successful execution flow, so crashes or interruptions can leave sensitive data at rest on disk longer than intended.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: A public endpoint can send logistics notification emails and optionally sync to OKKI based on request parameters, with no confirmation, consent, or access control visible in this file. Because logistics data often includes customer identities, shipment status, and business-sensitive information, this creates a meaningful risk of spam, data leakage, and unauthorized external propagation.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The script synchronizes logistics and customer data to an external OKKI system during an E2E run, and the integration is live enough to call real controller logic. In a test context this is risky because it can exfiltrate business/customer data to third-party systems or mutate external records without strong operator awareness or explicit gating.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: api/controllers/okki_sync_controller.js:41

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: test/e2e_test.js:75