ClawHub
Back to skill

Security audit

Bijie Express Tracking

Security checks for vulnerabilities and agentic risk

Overview

This skill is a coherent package-tracking integration, but users should know it sends tracking details to BijieServ and has some dependency/privacy hygiene issues.

Install only if you are comfortable sending package tracking numbers, and optional phone or address hints when needed, to BijieServ. Prefer removing or moving the unused clawhub dependency, pinning reviewed dependency versions, and improving output redaction before using this in a privacy-sensitive environment.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/express.py:282
Finding

Incomplete Sanitization of Sensitive Tracking Data

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Note
Location
package.json:7
Finding

Unnecessary Runtime Dependency Retrieved Through a Non-Default Registry Mirror

Content
View full analysis
=20" } } ``` ### Technical Analysis The skill's executable implementation is the Python script `scripts/express.py`; the audited code does not import or invoke the npm `clawhub` package. Nevertheless, `clawhub` is declared as a production dependency and introduces multiple transitive packages. The lockfile resolves these packages through `r.cnpmjs.org` rather than the default npm registry. Integrity hashes help detect content changes for the exact locked artifacts, but they do not eliminate risks arising from an unnecessary dependency, a compromised package release, a compromised registry mirror, or a future lockfile update. Declaring the package with the range `^0.9.0` also permits compatible updates when installation is performed without strict lockfile enforcement. The dependency therefore expands the installation attack surface without an identified runtime requirement. ### Attack Path 1. A user or deployment system ...[truncated 1191 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (10)

Known Vulnerable Dependency: undici==7.24.7 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more

High
Category
Supply Chain
Confidence
97% confidence
Finding

The lockfile includes undici 7.24.7, and the advisory set describes multiple HTTP client weaknesses including response queue poisoning, information disclosure, and request/response desynchronization issues. This skill is a package-tracking integration that is likely to make outbound HTTP requests to courier or aggregator APIs, so a vulnerable HTTP stack is especially relevant and could expose user data, corrupt responses, or enable cross-request interference under adversarial network conditions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
91% confidence
Finding

The skill directs the agent to make external package-tracking queries but does not declare any tool scope, permissions, or allowed-tools boundary. That creates an authorization and governance gap: an agent platform may permit network use implicitly, making it easier for the skill to trigger outbound requests without explicit operator review or least-privilege controls.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The description enumerates phrases like where is my package and track package, which are common conversational requests and may cause unintended activation in contexts outside this skill's intended workflow. The manifest text does not include explicit constraints or non-trigger examples to disambiguate activation.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The example trigger 帮我查这个快递到哪了 is broad natural language that many general conversations about packages could contain, without clearly constraining when this skill should activate versus when a broader assistant response would be more appropriate. The file does not provide exclusion conditions or negative examples to narrow invocation scope.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The request headers hard-code 'Accept-Language' to Chinese-preferred values, and the payload also fixes 'lang' to 'zh'. This is a natural-language locale constraint with no opt-in, configurability, or justification that the skill is intended only for a Chinese-language context.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The payload explicitly sets 'lang' to 'zh', which forces a specific language for responses. The file does not provide a user-selectable locale option or explain that the skill is intentionally limited to Chinese users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill transmits package tracking numbers and optional personal data such as phone number and address fields to a third-party service without any explicit consent flow, privacy notice, or minimization safeguards. Even if this is necessary for the feature, users may unknowingly disclose sensitive logistics and identity-linked data to an external provider, creating privacy and compliance risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: fflate==0.8.2 — 1 advisory(ies): CVE-2026-45820 (fflate unzipSync can enter an infinite loop when parsing malformed ZIP64 archive)

Low
Category
Supply Chain
Confidence
89% confidence
Finding

The lockfile pins fflate to 0.8.2, and the supplied advisory indicates a malformed ZIP64 archive can trigger an infinite loop in unzipSync. Even though this file alone does not prove the vulnerable code path is exercised, shipping a known-vulnerable version is a real supply-chain risk because a dependent package may process attacker-controlled archives and suffer denial of service.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
94% confidence
Finding

The dependency uses a caret range (^0.9.0), which allows installation of newer compatible releases rather than a single audited version. This creates supply-chain risk because future published versions of the package could introduce malicious code or breaking behavior without any change to this repository.

Content

Scanner excerpt · package.json (reported line 8)May include surrounding context.

json
"author": "bijieserv",
  "license": "MIT",
  "dependencies": {
    "clawhub": "^0.9.0"
  }
}

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This file begins with a Chinese-only heading and the table content is entirely in Chinese, with no indication that the skill is intentionally limited to Chinese-speaking users or a China-specific workflow. Under the language/locale policy, forcing a specific language without opt-in or justification can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.