Security audit

17TRACK

Security checks for vulnerabilities and agentic risk

Overview

This package-tracking skill mostly matches its stated purpose, but its optional webhook path can accept and store untrusted data too broadly and its daily report deletes delivered-package records.

Use this skill only if you are comfortable sending tracking numbers, carrier data, optional parameters, language, token-authenticated requests, and possibly label-derived tags to 17TRACK. Prefer manual polling over webhooks. Do not expose the webhook server beyond localhost until signature rejection and request-size limits are fixed. Avoid sensitive labels, and be aware that running the daily report removes delivered packages from the local database.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/track17.py:1237
Finding: Webhook Signature Validation Fails Open
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/track17.py:1388
Finding: Unbounded Webhook Requests Can Exhaust Memory and Disk
Content: View full analysis
None: # noqa: N802 server: "WebhookServer" = self.server # type: ignore[assignment] try: length = int(self.headers.get("Content-Length") or "0") except ValueError: length = 0 raw_body = self.rfile.read(length) if length > 0 else self.rfile.read() # Basic response first to keep provider happy. self.send_response(200) self.send_header("Content-Type", "application/json") self.end_headers() self.wfile.write(b"{\"ok\":true}\n") # Then spool payload to disk. server.spool(raw_body, dict(self.headers)) ``` The payload and all headers are written to disk without byte limits: ```python # Very small backpressure: if inbox is huge, drop oldest processed files. try: existing = sorted(self.inbox_dir.glob("*.json")) if len(existing) >= self.max_files: for old in existing[: max(0, len(existing) - self.max_files + 1)]: try: old.unlink() side = old.with_suffix(".headers.json") if side.exists(): side.unlink() except Exception: pass except Exception: pass fpath.write_bytes(raw_body) (self.inbox_dir / f"{fpath.stem}.headers.json").write_text(json.dumps(headers), "utf-8") ``` ### Technical Analysis The HTTP handler trusts `Content-Length` and reads the declared amount into memory without imposing a maximum request size. If the header is absent, zero, or malformed, it calls `self.rfile.read()` without a bound, potentially waiting for connection closure and tying up a request thread. The inbox limit controls only the number of JSON files, not their aggregate size. A single request can therefore consume substantial memory and disk. Repeated large requests can c ...[truncated 1631 chars]
Remediation: View remediation
MAX_WEBHOOK_BYTES: self.send_error(413, "Payload too large") return raw_body = self.rfile.read(length) if len(raw_body) != length: self.send_error(400, "Incomplete request body") return ``` 4. Configure socket read timeouts and concurrency limits to mitigate slow-request attacks. 5. Validate authentication and JSON structure before acknowledging and writing the request. 6. Enforce both per-file and aggregate inbox byte quotas. 7. Store only required headers, such as the signature header and content type; redact authorization, cookie, and proxy-authentication headers. 8. Use a TLS-enabled, rate-limited reverse proxy when exposing the server beyond localhost. 9. Retain the secure loopback default and warn or require explicit confirmation when binding to a non-loopback address. ]]>

T09 · Insecure Skill Coding Practices

Note

Location: scripts/track17.py:743
Finding: Local Package Labels Are Unnecessarily Transmitted to 17TRACK
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill description advertises API polling and webhook ingestion but does not clearly disclose that tracking numbers, shipment metadata, and related updates are sent to an external third-party service. Because shipment data can reveal sensitive personal or business logistics information, the missing privacy warning reduces informed consent and can lead to inappropriate exposure of user data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger examples are broad enough to match generic phrases like 'where is my package?' or 'any updates on my orders?', which can cause the skill to activate in contexts the user did not clearly intend. In a package-tracking skill that can query external services and manipulate stored tracking data, over-broad routing increases the chance of unintended data disclosure or unintended actions.
Content: No source excerpt is available for this finding.

Autonomous Decision Making

Medium

Category: Excessive Agency
Confidence: 90% confidence
Finding: Automatic removal of delivered packages is an autonomous action that changes local state without an explicit per-item user decision. In the context of shipment records, this can destroy useful history and create operational or evidentiary issues if a delivery is disputed or if cleanup logic behaves incorrectly.
Content: Scanner excerpt · README.md (reported line 35)May include surrounding context.
md
- **Add packages** — "track RR123456789CN, it's my new headphones" - **Check status** — "where is my package?" / "any updates on my orders?" - **Sync updates** — polls 17TRACK API for latest tracking events - **Auto-cleanup** — delivered packages are automatically removed by daily reports - **Webhook support** — optional real-time push updates from 17TRACK ## Features

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The README states that delivered packages are automatically removed by daily reports, but it does not clearly warn users that package history may be deleted without explicit review or consent. This creates a data-retention and integrity risk because users may lose records they expected to preserve for disputes, audits, or reimbursement purposes.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill declares broad operational capabilities in practice (environment access, filesystem reads/writes, network access, and shell execution) but does not explicitly constrain them with a tool scope. That increases the blast radius if the skill is invoked unexpectedly or modified later, because the agent may grant more authority than is necessary for parcel tracking tasks.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The invocation guidance includes very broad trigger phrases such as 'track this', 'where is my order', and 'any updates on my package', which can match common conversational requests without sufficient user intent verification. In a skill with network, shell, and local database capabilities, over-broad activation can cause unnecessary external API calls, local state changes, or processing of sensitive shipment data when the user did not clearly intend to use this specific integration.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/track17-daily-report.py (reported line 49)May include surrounding context.
python
print("❌ TRACK17_TOKEN not set") return False result = subprocess.run( [sys.executable, str(TRACK17_SCRIPT), "sync"], capture_output=True, text=True,

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · scripts/track17-daily-report.py (reported line 90)May include surrounding context.
python
def remove_package(pkg_id): """Remove a package via track17.py.""" result = subprocess.run( [sys.executable, str(TRACK17_SCRIPT), "remove", str(pkg_id)], capture_output=True, text=True,

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The script automatically removes delivered packages during report generation, creating an unexpected destructive side effect for what appears to be a read/report operation. In this skill context, package tracking data may be operationally important, so silent deletion can cause loss of audit/history, user confusion, and missed follow-up actions if delivery records are needed later.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · README.md (reported line 13)May include surrounding context.
md
import urllib.request from typing import Any, Dict, Iterable, List, Optional, Sequence, Tuple API_BASE = "https://api.17track.net/track/v2.2" CARRIERS_URL = "https://res.17track.net/asset/carrier/info/apicarrier.all.json"

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/track17.py (reported line 62)May include surrounding context.
python
import urllib.request from typing import Any, Dict, Iterable, List, Optional, Sequence, Tuple API_BASE = "https://api.17track.net/track/v2.2" CARRIERS_URL = "https://res.17track.net/asset/carrier/info/apicarrier.all.json"

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: This code writes raw webhook bodies and request headers to files in the local inbox directory, which can include tracking data and metadata from external requests. Although the module docstring mentions webhook ingestion and storage directories, there is no nearby user-facing warning, confirmation, or explicit disclosure when enabling the webhook server that incoming request contents and headers will be persisted to disk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The docstring frames the script as producing stdout-only reporting with no effects beyond contacting 17TRACK, but main() performs auto-cleanup by calling track17.py remove for delivered packages. That behavior changes local tracking state, so the documentation understates the script's side effects.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The status formatter hardcodes Italian-language labels such as In Transito, Consegnato, and Non Trovato regardless of user preference. This imposes a specific language/locale in natural-language output without offering choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The natural-language documentation states the default translation language is "en", and the code uses English as the fallback language in multiple places. This imposes a specific locale by default rather than prompting for or offering a language choice at runtime.
Content: No source excerpt is available for this finding.