Send real Document in the Mail via PostalForm

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:33 PM UTC
• Version: 1.0.0

Overview

This skill is purpose-built for paid physical mail delivery, but it needs review because it can transmit personal documents and addresses, spend wallet funds, and trigger an irreversible real-world mailing without a clearly required user approval step.

Review carefully before installing. Use this only when you are comfortable sending the letter contents, names, email, and postal addresses to PostalForm and paying for real physical delivery. Require a final human approval before payment/submission, set a strict payment cap, and avoid command forms that put wallet passwords or full payloads in process arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: references/payload_templates.md:50

Finding

Sensitive Postal Payload and Wallet Password Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: references/payload_templates.md, lines 50-58
Vulnerability Type: Sensitive information exposure through process arguments
Risk Level: Medium

Vulnerable Code Snippet:

bash

purl \
  --wallet ~/.purl/keystores/my-wallet.json \
  --password "$PURL_PASSWORD" \
  --network eip155:8453 \
  --max-amount 5000000 \
  --output-format json \
  -X POST \
  --json "$(cat payload.json)" \
  "https://postalform.com/api/machine/orders"

Technical Analysis

The example expands both the wallet password and the complete contents of payload.json into the purl process argument vector.

Although the password originates from an environment variable, "$PURL_PASSWORD" is expanded by the shell before process creation and passed as the value of the --password argument. Similarly, $(cat payload.json) expands the complete order payload into the --json argument.

According to the documented payload structure, this JSON may contain:

• Buyer name and email address
• Sender and recipient names
• Sender and recipient postal addresses
• The complete PDF as base64-encoded data
• Order and mailing configuration

Process arguments can be captured by process inspection facilities, endpoint-monitoring software, audit systems, debugging tools, shell tracing, or crash diagnostics. The exact exposure depends on operating-system access controls and monitoring configuration, but secrets and private document contents should not be placed in command-line arguments.

Attack Path

1. A user follows the documented purl command to submit a postal order.
2. The shell expands $PURL_PASSWORD and $(cat payload.json) before launching purl.
3. The wallet password and complete order payload become part of the process argument vector.
4. While the command is running—or through retained process telemetry—an authorized local user, administrator, monitoring agent, or com ...[truncated 1012 chars]

Remediation

View remediation

Remediation Suggestions

• Do not pass wallet passwords or complete postal payloads through command-line arguments.
• Use a purl password prompt, stdin, an inherited file descriptor, or another tool-supported secret-input mechanism that does not expose the value in the argument vector.
• Pass the JSON request body through stdin or a protected file-reference option rather than using --json "$(cat payload.json)".
• If a temporary payload file is required, create it with owner-only permissions such as mode 0600, store it in a protected directory, and securely remove it after use.
• Disable shell tracing around commands that handle sensitive values and ensure command invocations are not written to diagnostic or audit logs unnecessarily.
• Prefer an OS credential store, hardware wallet, or encrypted keystore with interactive authorization over reusable plaintext passwords.
• Update the documentation with a safe example supported by the selected client, and explicitly warn operators not to include passwords, PDFs, addresses, or other sensitive values in process arguments.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill enables autonomous transmission of sender/recipient names, addresses, and buyer contact data to a third-party postal service and causes a real-world action: printing and mailing a physical letter. Without an explicit user-facing warning and confirmation step about privacy disclosure and irreversible physical delivery, an agent could send sensitive or incorrect information externally without adequate user awareness or consent.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/payload_templates.md (reported line 40)May include surrounding context.

Validate first

bash

curl -sS -X POST "https://postalform.com/api/machine/orders/validate" \
  -H "content-type: application/json" \
  --data @payload.json