T09 · Insecure Skill Coding Practices
Error
- Location
scripts/anomaly-detector.js:545- Finding
Arbitrary File Write Through Path Traversal in Discord Alert Filename
- Content
View full analysis
- Remediation
View remediation
Security audit
Logistics Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill’s logistics automation purpose is mostly disclosed, but its implementation has real safety flaws around local file writes and unescaped customer-facing email content.
Treat this as requiring review before installation. Fix the alert filename path traversal and HTML escaping issues first, use dry-run until verified, keep API/SMTP credentials dedicated and least-privileged, and run any scheduler under an unprivileged account with limited writable paths.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/customer-notify.js:290- Finding
Stored HTML Injection in Customer Notifications and Anomaly Alert Emails
- Content
View full analysis
Dear ${customerName},Great news! Your order${orderId ? ' ' + orderId + '' : ''} has been shipped via ${carrierName}.
${orderId ? '' : ''}Tracking Number
${trackingNumber}
``` Carrier event descriptions and event times are also inserted directly: ```js const eventDesc = data.event_description || 'There is an update regarding your shipment.'; const eventTime = data.event_time || ''; return ` ${baseStyle}Order ID ' + orderId + ' Carrier ${carrierName} Tracking No. ${trackingNumber} ⚠️ Shipping Update
Dear ${customerName},
We have an update regarding your shipment${orderId ? ' for order ' + orde ...[truncated 3731 chars]
- Remediation
View remediation
/g, '>') .replace(/"/g, '"') .replace(/'/g, '''); } ``` 2. Escape values before interpolation: ```js const customerName = escapeHtml(data.customer_name || 'Valued Customer'); const carrierName = escapeHtml(data.carrier_name || 'the carrier'); const trackingNumber = escapeHtml(data.tracking_number); const orderId = escapeHtml(data.order_id || ''); const eventDesc = escapeHtml(data.event_description || defaultDescription); const eventTime = escapeHtml(data.event_time || ''); ``` 3. Apply the same encoding to anomaly fields, including `message`, `trackingNumber`, `carrier`, `customerName`, and fallback type labels. 4. Preserve separate raw and presentation-safe values. Use the raw tracking number only when URL-encoding the tracking link; use an HTML-escaped copy for visible text. 5. If rich text is intentionally supported, sanitize it with a mature allowlist-based HTML sanitizer and prohibit scripts, forms, embedded objects, event-handler attributes, unsafe URL schemes, and CSS capable of obscuring content. 6. Validate field lengths and formats when importing order data and tracking-provider responses. 7. Strip carriage-return and newline characters from email subjects and validate recipient addresses, even though the current SMTP invocation uses an argument array rather than a shell. 8. Add tests using payloads such as HTML links, image tags, quoted attributes, malformed markup, and encoded entities to verify that generated messages render the payload as text. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (48)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 88% confidence
- Finding
The skill's declared purpose does not fully disclose its effective behaviors, including reading order data, writing shipment state, and sending alerts through additional channels. This mismatch can mislead operators into approving a skill with broader data access and side effects than expected, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 91% confidence
- Finding
The skill's declared purpose does not fully disclose its effective behaviors, including reading order data, writing shipment state, and sending alerts through additional channels. This mismatch can mislead operators into approving a skill with broader data access and side effects than expected, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The skill's declared purpose does not fully disclose its effective behaviors, including reading order data, writing shipment state, and sending alerts through additional channels. This mismatch can mislead operators into approving a skill with broader data access and side effects than expected, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The skill's declared purpose does not fully disclose its effective behaviors, including reading order data, writing shipment state, and sending alerts through additional channels. This mismatch can mislead operators into approving a skill with broader data access and side effects than expected, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill's declared purpose does not fully disclose its effective behaviors, including reading order data, writing shipment state, and sending alerts through additional channels. This mismatch can mislead operators into approving a skill with broader data access and side effects than expected, increasing the chance of unintended data exposure or unauthorized actions.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/scheduler.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/scheduler.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/scheduler.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/scheduler.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/anomaly-detector.js
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/tracking-extractor.js --text "Your UPS shipment 1Z999AA10123456784 has shipped"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/tracking-extractor.js --text "Your UPS shipment 1Z999AA10123456784 has shipped"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/tracking-extractor.js --text "Your UPS shipment 1Z999AA10123456784 has shipped"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/tracking-extractor.js --text "Your UPS shipment 1Z999AA10123456784 has shipped"
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Subtask 2** — 创建 17Track API 适配器 `tracking-api.js`（批量注册+查询、3 路径响应解析、配额四级监控、pause_non_critical 降级、exponential backoff）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Subtask 3** — 创建状态管理 `shipment-store.js`（原子写入、9 状态状态机、eventId SHA256 去重、赔偿流程提醒）
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **Subtask 4** — 创建客户通知模块 `customer-notify.js`（3 套 HTML 模板、频率控制、决策引擎、17track 自助链接）
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 85% confidence
- Finding
The skill documentation describes capabilities that imply access to environment-derived secrets and external integrations, but it does not declare any explicit tool scope or permissions boundary. In agent environments, missing permission declarations can cause overbroad execution authority or make reviewers unaware that API keys, SMTP credentials, and filesystem access are required.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill advertises automatic customer notifications and alerting but does not prominently warn that it will transmit customer-related shipment data to external services and recipients. In practice, this can lead to accidental disclosure of personal data, shipment identifiers, or operational details when an operator runs the skill assuming it is passive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Referencing SMTP credentials in a dependent skill without explicit handling guidance increases the risk of unsafe secret storage, accidental disclosure, or misuse of mail infrastructure. Because the skill can send external messages, poor credential hygiene can also enable spam, impersonation, or broader compromise of communication systems.
- Content
Static analysis
Detected: suspicious.dangerous_exec
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/anomaly-detector.js:610
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/customer-notify.js:536