Security audit

Package Tracker

Security checks for vulnerabilities and agentic risk

Overview

This package-tracking skill looks safe from a system-access perspective, but it advertises real-time tracking while returning locally invented delivery statuses.

Install only if you understand this behaves like a demo or mock tracker, not a real parcel-tracking service. Do not use its results for delivery decisions, customer notifications, refunds, or operational workflows unless the publisher replaces the simulation with real carrier lookups or clearly labels every result as simulated.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

other

Warning

Location: scripts/track.py:29
Finding: Fabricated Package Events Presented as Tracking Results
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: scripts/track.py:53
Finding: Terminal Control-Sequence Injection Through Unvalidated Tracking Numbers
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The declared description presents the skill as a real parcel-tracking service with one-click logistics trajectory queries across many domestic and international couriers. However, the supplied code does not contact any carrier APIs or external services at all. Instead, it infers a carrier from regex/prefix patterns and returns fabricated demo events via simulate_tracking, explicitly labeled as 'Demo data - register for real carrier API for live tracking'. This is a material mismatch in primary functionality: simulated output versus real-time tracking. The code is otherwise aligned with the general domain of package tracking and does not show unrelated or suspicious undeclared capabilities, but the core promise of live tracking and broad carrier support is not actually implemented.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill advertises real-time package tracking across multiple carriers, but the implementation fabricates shipment events locally instead of querying any carrier or logistics API. This is dangerous because users may make decisions based on false delivery status information, and the mismatch between claimed functionality and actual behavior is deceptive.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill body presents its title, summary, features, and usage primarily in Chinese, with no statement that users may choose another language. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is clearly documented and justified.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The module docstring claims shipment tracking capability, but the code path only detects carrier-like formats and then generates synthetic timeline data. In the context of a package-tracking skill, this misleading representation increases the risk of user deception and undermines trust, even if it does not directly enable code execution or data theft.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.