Security audit

Kuaidi Query

Security checks for vulnerabilities and agentic risk

Overview

The skill does what it says, but it ships a real-looking Track123 credential and stores shipment results in a local plaintext cache.

Review this skill before installing. Replace and rotate the packaged Track123 credential, remove config.json from the published package, use your own minimally scoped API secret, and be aware that tracking numbers and shipment history are sent to Track123 and cached locally unless caching is disabled.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: config.json:2
Finding: Hard-Coded Track123 API Credential Distributed in Plaintext
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/query.js:103
Finding: Shipment Tracking Data Stored in a Predictable Plaintext Cache
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Note

Location: package-lock.json:14
Finding: Dependency Lockfile Uses a Third-Party Package Registry Mirror
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (29)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 45)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 51)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 100)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 136)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 188)May include surrounding context.
md
node scripts/query.js sf SF1234567890123

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 95% confidence
Finding: The lockfile pins axios 1.13.6, which the supplied advisory data identifies as having multiple known vulnerabilities, including SSRF- and prototype-pollution-related issues. In a logistics-query skill that makes outbound HTTP requests to a third-party API, a vulnerable HTTP client is directly security-relevant because attacker-controlled inputs, redirects, proxy settings, or polluted objects could influence requests and responses.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

Category: Supply Chain
Confidence: 83% confidence
Finding: form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names and filenames. If this skill ever constructs multipart requests using user-influenced field names or filenames, an attacker may be able to inject crafted headers or corrupt request structure sent to upstream services.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 98% confidence
Finding: The manifest references axios 1.13.6, which is reported here as having multiple known advisories, including SSRF-related and man-in-the-middle/prototype-pollution-related issues. Because this skill queries an external tracking API over HTTP(S), a vulnerable HTTP client is directly relevant and could enable request manipulation, credential leakage, or unsafe network access depending on how the skill is implemented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The examples instruct users to submit tracking numbers to the Track123 external API but do not disclose that shipment identifiers and related logistics metadata will be sent to a third party. Tracking numbers can be sensitive in some contexts because they may reveal shipment status, locations, carrier relationships, and potentially business or personal activity patterns; the lack of notice undermines informed consent and safe handling expectations.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The documentation instructs users to send an API key and shipment tracking number to a third-party service, but it does not warn that package metadata and possibly personal logistics details will leave the local environment. In an agent skill context, silent external transmission is security-relevant because users may not realize their tracking numbers, destination data, and signed-by details are disclosed to an outside provider.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 47)May include surrounding context.
请求示例:

bash
curl -X POST https://api.track123.com/gateway/open-api/tk/v2.1/track/query-realtime \ -H "Content-Type: application/json" \ -d '{ "app_key": "your_app_key",

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 236)May include surrounding context.
md
import requests def query_tracking(tracking_number, carrier_code, language='zh'): response = requests.post( 'https://api.track123.com/gateway/open-api/tk/v2.1/track/query-realtime', json={ 'app_key': 'your_app_key',

External Transmission

Medium

Category: Data Exfiltration
Confidence: 70% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 236)May include surrounding context.
md
import requests def query_tracking(tracking_number, carrier_code, language='zh'): response = requests.post( 'https://api.track123.com/gateway/open-api/tk/v2.1/track/query-realtime', json={ 'app_key': 'your_app_key',

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 5)May include surrounding context.
md
const CACHE_PATH = path.join(SKILL_ROOT, '.cache.json'); // Track123 API 基础地址 const API_BASE = 'https://api.track123.com/gateway/open-api/tk/v2'; // 缓存时长 (毫秒) const CACHE_DURATION = 3600000;

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 47)May include surrounding context.
md
const CACHE_PATH = path.join(SKILL_ROOT, '.cache.json'); // Track123 API 基础地址 const API_BASE = 'https://api.track123.com/gateway/open-api/tk/v2'; // 缓存时长 (毫秒) const CACHE_DURATION = 3600000;

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 217)May include surrounding context.
md
const CACHE_PATH = path.join(SKILL_ROOT, '.cache.json'); // Track123 API 基础地址 const API_BASE = 'https://api.track123.com/gateway/open-api/tk/v2'; // 缓存时长 (毫秒) const CACHE_DURATION = 3600000;

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · references/track123-api.md (reported line 237)May include surrounding context.
md
const CACHE_PATH = path.join(SKILL_ROOT, '.cache.json'); // Track123 API 基础地址 const API_BASE = 'https://api.track123.com/gateway/open-api/tk/v2'; // 缓存时长 (毫秒) const CACHE_DURATION = 3600000;

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/query.js (reported line 21)May include surrounding context.
js
const CACHE_PATH = path.join(SKILL_ROOT, '.cache.json'); // Track123 API 基础地址 const API_BASE = 'https://api.track123.com/gateway/open-api/tk/v2'; // 缓存时长 (毫秒) const CACHE_DURATION = 3600000;

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: Queried shipment results are persisted to .cache.json on disk without any explicit notice, which can leave sensitive logistics history, addresses, status updates, or recipient information available to other local users or later processes. Because caching is enabled by default, this creates silent data retention beyond the immediate query operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script sends tracking numbers to the Track123 third-party service as part of its core function, which exposes shipment identifiers and related logistics metadata to an external party. While expected for a tracking integration, the call sites do not provide an explicit user-facing privacy warning or consent prompt, so users may not realize their shipment data is leaving the local environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: The options table specifies --lang <zh|en|ru> with a default of zh, which establishes a language preference in the skill's behavior. Under the policy, locale or language constraints should either be user-selected or clearly justified; this default is not accompanied by an opt-in explanation or region-specific rationale in the document.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

Category: Supply Chain
Confidence: 87% confidence
Finding: follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. For a skill that likely calls an external tracking API with API keys or bearer tokens, this could expose credentials to an attacker-controlled redirect target if redirects are followed automatically.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: scripts/query.js:135