海外物流Skill合集

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:12 AM UTC
• Version: 1.0.1

Overview

The skill is purpose-aligned for JD logistics lookups, but it handles tokens and user-supplied query values in ways that create serious security review concerns.

Review before installing. Use only with a narrowly scoped JD logistics token, avoid storing secrets in ~/.env or shared user profiles, and do not run the command templates with raw user input. The TLS bypass and unquoted command instructions should be fixed before production use.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: skills/joy-logistics-indicator/scripts/get_isc_data.js:41

Finding

TLS Certificate Verification Is Disabled for All API Requests

Content

View full analysis

Vulnerability Details

File Locations:

• skills/joy-logistics-indicator/scripts/get_isc_data.js:41-54
• skills/joy-logistics-indicator/scripts/get_cross_board_data.js:54-67
• skills/joy-logistics-trace/scripts/get_tracking_data.js:49-62

Vulnerability Type: Improper TLS certificate validation
Risk Level: High

Vulnerable Code

skills/joy-logistics-indicator/scripts/get_isc_data.js:

js

const options = {
  hostname: 'us-api.jd.com',
  port: 443,
  path: '/uis/getUisIscDataByCondition4Customer',
  method: 'POST',
  headers: {
    'LOP-DN': 'iplat.skill.http.outer.jd.com',
    'Content-Type': 'application/json',
    'token': token,
    'Content-Length': Buffer.byteLength(postData)
  },
  rejectUnauthorized: false
};

skills/joy-logistics-indicator/scripts/get_cross_board_data.js:

js

const options = {
  hostname: 'us-api.jd.com',
  port: 443,
  path: '/uis/getCrossBoardByCondition4Customer',
  method: 'POST',
  headers: {
    'LOP-DN': 'iplat.skill.http.outer.jd.com',
    'Content-Type': 'application/json',
    'token': token,
    'Content-Length': Buffer.byteLength(postData)
  },
  rejectUnauthorized: false
};

skills/joy-logistics-trace/scripts/get_tracking_data.js:

js

const options = {
  hostname: 'lop-proxy.ochama.com',
  port: 443,
  path: '/global/trackingOpenExport/queryTrackingBatch',
  method: 'POST',
  headers: {
    'LOP-DN': 'ifop.skill.eu.outer.jd.com',
    'Content-Type': 'application/json',
    'token': token,
    'Content-Length': Buffer.byteLength(postData)
  },
  rejectUnauthorized: false
};

Technical Analysis

The rejectUnauthorized: false option instructs Node.js to accept a TLS certificate even when it is expired, self-signed, issued for another hostname, or signed by an untrusted authority. Encryption may still be negotiated, but the client no longer authenticates the server. ...[truncated 1759 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove rejectUnauthorized: false from all three request configurations and rely on Node.js certificate validation defaults.
2. If an internal certificate authority is required, load only the required CA certificate through the ca option. Do not disable verification globally.
3. Keep hostname verification enabled and restrict requests to the documented hostnames.
4. Rotate the API token after deployment of the fix if the scripts have been used over untrusted networks.
5. Apply least-privilege scopes and short expiration periods to tokens.
6. Treat certificate or TLS validation failures as fatal and avoid retrying through an insecure connection.
7. Add automated tests that confirm connections with self-signed, expired, or hostname-mismatched certificates are rejected.

T09 · Insecure Skill Coding Practices

Error

• Location: skills/joy-logistics-indicator/SKILL.md:159

Finding

User-Controlled Values Are Inserted into Unquoted Shell Commands

Content

View full analysis

Vulnerability Details

File Locations:

• skills/joy-logistics-indicator/SKILL.md:159-177
• skills/joy-logistics-indicator/SKILL.md:371-389
• skills/joy-logistics-trace/SKILL.md:15-27

Vulnerability Type: Shell command injection
Risk Level: High

Vulnerable Code

The indicator Skill instructs the Agent to insert eight raw values into a command:

bash

node {baseDir}/scripts/get_isc_data.js dims_value monthList_value indicatorCode_value dateList_value warehouseNoList_value warehouseNameList_value continentList_value customerCodeList_value

The cross-border query similarly inserts user-derived values directly:

bash

node {baseDir}/scripts/get_cross_board_data.js date_list dimension_list

The tracking Skill places shipment references directly into the command:

bash

node {baseDir}/scripts/get_tracking_data.js number1,number2,number3

These templates are accompanied by mandatory instructions that parameter values must be passed without quotes. Several values originate from natural-language user input, including warehouse names and shipment reference numbers.

Technical Analysis

When a command is executed through a shell, quoting and argument separation are security boundaries. Passing user-derived text without quoting allows shell metacharacters, substitutions, redirections, pipes, or argument separators to be interpreted as shell syntax rather than as data.

The JavaScript programs themselves do not create a child shell. The vulnerable boundary is the Skill execution procedure: it directs the Agent or orchestration layer to construct a shell command by textual substitution. The scripts also do not enforce strict allowlists for every supplied value.

For example, a crafted warehouse name or shipment reference containing a command separator can terminate the intended argument and append another command. A payload does not necessarily require spaces, because shell syntax and ...[truncated 1222 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not build commands by concatenating user-controlled text.
2. Invoke Node.js with an argument-array API such as spawn() or execFile() and set shell: false.
3. Pass every logical input as a distinct argument rather than generating one command string.
4. Remove the instructions requiring unquoted parameter values.
5. Enforce strict allowlists before execution:
   • Dates must match valid YYYY-MM-DD or YYYY-MM values.
   • Indicator and warehouse codes must match their documented character and length constraints.
   • Dimensions and continents must come from fixed enumerations.
   • Shipment references should permit only the documented alphanumeric character set and a bounded length.
6. Reject shell metacharacters and control characters in all free-form names.
7. Limit the number and total length of list entries to prevent argument and request-size abuse.
8. Run the Skill under a dedicated, least-privileged account without access to unrelated secrets or sensitive files.

T08 · Insecure Dependencies

Warning

• Location: README.md:29

Finding

Installation Instructions Use Unpinned Third-Party Packages and Skills

Content

View full analysis

Vulnerability Details

File Location: README.md:29-32,54-63
Vulnerability Type: Unpinned third-party dependency and mutable registry installation
Risk Level: Medium

Vulnerable Code

bash

# Install ClawHub CLI
npm i -g clawhub

bash

# Install one Skill
clawhub install joy-logistics-indicator --dir ~/.workspace/skills

# Install all logistics Skills
for skill in joy-logistics-indicator joy-logistics-trace; do
  clawhub install "$skill" --dir ~/.workspace/skills --force
done

Technical Analysis

The installation instructions retrieve packages and Skills by mutable names without pinning an exact reviewed version or integrity digest. The effective installed content can therefore differ from the content audited in this project.

Installing the CLI globally increases the impact of a compromised npm release. The --force option additionally permits registry content to overwrite an existing local Skill without a separate integrity or review step.

This does not prove that the current upstream packages are malicious. It creates a supply-chain trust gap in which a future package takeover, compromised publisher account, registry breach, or unexpected release can introduce code that was not part of this audit.

Attack Path

1. An attacker compromises an upstream publisher account, package, Skill release, or registry distribution path.
2. The attacker publishes altered content under one of the unchanged package or Skill names.
3. A user follows the README at a later time.
4. The package manager resolves the mutable name to the attacker-controlled release.
5. The global CLI installation or forced Skill installation places the altered code on the host.
6. The compromised code executes when the CLI or installed Skill is invoked.

Impact Assessment

Impact depends on the behavior of the compromised upstream artifact. A malicious CLI or Skill could execute code with the instal ...[truncated 366 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the ClawHub CLI to an exact reviewed version instead of installing the mutable latest release.
2. Pin each Skill to an exact version, immutable commit, or content digest supported by the registry.
3. Record and verify integrity hashes before installation.
4. Document the expected publisher identity and canonical source repository.
5. Prefer a project-local CLI installation over a global installation.
6. Remove --force from routine installation instructions. Require explicit review and confirmation before replacing an existing Skill.
7. Re-audit downloaded artifacts whenever their version or digest changes.
8. Use a lockfile or equivalent reproducible dependency manifest where supported.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The documentation includes credential setup and references storing a logistics API key in a local .env file, which is a credential-access pattern because it normalizes handling live secrets in plaintext configuration. Even though the visible token appears masked, the practice increases the likelihood of secret disclosure via local file compromise, accidental repository inclusion, endpoint backups, or agent/tooling access to home-directory files.

Content

Scanner excerpt · README.md (reported line 39)May include surrounding context.

MAC/Linux

bash

cat > ~/.env << 'EOF'
# 京东物流 API 配置
api_key=66Pi3xz*******yzNHvRNJgeJsqtSkn7fcJ4 
EOF

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 13)May include surrounding context.

js

const fs = require('fs');
const path = require('path');

// 自动从 ~/.env 读取 joy_token
// let token = '';
// try {
//   const envPath = path.join(process.env.HOME, '.env');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 26)May include surrounding context.

js

const fs = require('fs');
const path = require('path');

// 自动从 ~/.env 读取 joy_token
// let token = '';
// try {
//   const envPath = path.join(process.env.HOME, '.env');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 16)May include surrounding context.

js

// 自动从 ~/.env 读取 joy_token
// let token = '';
// try {
//   const envPath = path.join(process.env.HOME, '.env');
//   const envContent = fs.readFileSync(envPath, 'utf8');
//   const match = envContent.match(/^joy_token=(.+)$/m);
//   if (match) token = match[1].trim();

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Setting rejectUnauthorized to false disables TLS certificate validation, allowing a man-in-the-middle attacker to impersonate the remote HTTPS service and intercept or modify requests and responses. In this script, that could expose the authentication token sent in headers and tamper with logistics or operational data returned to the skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script explicitly sets rejectUnauthorized: false for an HTTPS request, which disables TLS certificate validation and allows man-in-the-middle interception or spoofing of the us-api.jd.com endpoint. Because this skill sends authentication data (token header) and queries potentially sensitive international logistics and operational metrics, an attacker on the network path could steal credentials, tamper with responses, or inject false business data.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

This is the same underlying security issue: outbound HTTPS is configured without certificate verification and there is no warning or compensating control. That makes the confidentiality and integrity of both the bearer token and returned logistics data dependent on an unauthenticated TLS session, enabling interception and response manipulation.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script explicitly sets rejectUnauthorized: false, which disables TLS certificate validation for the outbound HTTPS request. This allows a man-in-the-middle attacker to present an untrusted certificate, intercept the logistics query, read or modify tracking data, and potentially steal the authentication token sent in the request headers. In this skill context, the risk is elevated because the script handles operational logistics data and sends a token to an external endpoint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The README instructs users to place an API key/token in environment configuration but does not warn about sensitive-secret handling, rotation, least privilege, or avoiding committing secrets to disk or shell history. In a skill intended for installation and local use, this can lead to accidental credential exposure through copied examples, checked-in dotfiles, screenshots, or shared workstation environments.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Throughout the file, instructions, fixed prompts, and required reply formats are specified only in Chinese, including mandatory user-facing text. There is no opt-in language selection or explanation that this skill is intentionally restricted to Chinese for a documented regional or compliance reason.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

前文参数定义使用 warehouseCodeList、ownerNoList 等字段，但 L169-L176 的固定命令顺序和模板却使用 warehouseNoList、customerCodeList，且 8 个命令参数并未覆盖前面列出的多项可提取参数。文档一边声明支持多维度多字段查询，一边给出不一致的实际调用接口，属于意图与执行说明冲突。

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This markdown file explicitly tells the skill to run local Node scripts to retrieve data, which is an operational action affecting the user's system/runtime context. The surrounding instructions do not provide any warning that the skill will invoke command-line programs or access backend data sources before doing so.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The text states that environment variables must be checked before running the cross-border query flow, which implies access to potentially sensitive configuration or credentials. There is no accompanying user disclosure explaining that the skill may read configured environment values as part of execution.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes query capabilities for logistics tracking and operational metrics, but does not justify or declare accessing local process environment for credentials. Reading a token from environment variables is a separate capability involving local secret access, which is not part of the stated user-facing purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill directs the agent to send user-supplied logistics identifiers to an external JD logistics interface, but it does not instruct the agent to warn the user that tracking numbers, order numbers, and related shipment metadata may be transmitted to and processed by a third party. This creates a privacy and consent risk because users may disclose personal or commercially sensitive shipment data without understanding where it is going or what related data may be returned.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The request payload hard-codes the locale to "zh-CN", which imposes a specific language/locale behavior on all users. This is a natural-language policy concern because the file does not offer any opt-in, configurability, or justification for why only Chinese locale is acceptable.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The natural-language instructions and examples are entirely in Chinese, which may impose a language constraint on users without opt-in or justification. The file does not indicate that the skill is intentionally region- or language-specific, nor does it offer an alternative language.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown explicitly states that the complete setup guide is in Chinese, while the document otherwise includes English text and does not indicate that the skill is region-specific or provide an alternative language option. This creates a natural-language locale constraint without user choice, which matches the policy-violation category.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

L219 将 warehouseType 说明为“内外单标识”，L220 又将 orderFlag 说明为“仓库类型”，这与前文参数定义中 warehouseTypeList 表示仓库类型、orderFlagList 表示内外单标识的含义相反。该文档会直接误导实现方解析和展示返回字段。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

L468 要求无匹配数据时“仅单独返回固定文案”未查询到指标数据，请检查查询条件是否正确，但 L500 又规定空结果返回 该客户不存在或者没有全程履约率。这两处文档对同一情形给出了互相冲突的处理指令，属于文档意图与实际执行指令不一致。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The active code obtains the token from an environment variable, while the emitted error message says the token was not read from ~/.env. This is a direct contradiction between the code's behavior and its user-facing inline intent/documentation, which can mislead operators during troubleshooting.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file includes natural-language comments in Chinese describing the function as a Windows compatibility helper, but there is no indication that the skill is intentionally region-specific or that users can choose language. Under the language/locale policy, forcing a specific language without opt-in can be a policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The file mandates a fixed Chinese response format such as '物流轨迹详情' and a hardcoded Chinese fallback message for no-result cases. This imposes a specific language on outputs without indicating user opt-in or offering locale selection.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.