Security audit

Parcel Tracking

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims: it sends a tracking number and optional postal code to Track123 to return parcel tracking status.

Install only if you are comfortable providing a Track123 API secret and sending tracking numbers, and optionally postal codes, to Track123. The bundled virtual environment is unnecessary but did not show harmful behavior in this review.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.exposed_secret_literal, suspicious.insecure_tls_verification

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: venv/lib/python3.14/site-packages/pip/_vendor/pygments/formatters/__init__.py:91

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_internal/network/auth.py:97

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:423

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connectionpool.py:991

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/_securetransport/low_level.py:231

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/socks.py:102

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/requests/adapters.py:257

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/requests/sessions.py:322

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/urllib3/connection.py:807

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/urllib3/connectionpool.py:1073

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: venv/lib/python3.14/site-packages/urllib3/contrib/socks.py:116

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_internal/network/session.py:312

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/truststore/_macos.py:371

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/truststore/_windows.py:458

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/connection.py:454

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/pyopenssl.py:113

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/contrib/securetransport.py:794

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/pip/_vendor/urllib3/util/ssl_.py:140

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/urllib3/connection.py:951

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/urllib3/contrib/pyopenssl.py:84

HTTPS certificate verification is disabled.

Warn

Code: suspicious.insecure_tls_verification
Location: venv/lib/python3.14/site-packages/urllib3/util/ssl_.py:353