Security audit

国际平台组测试合集

Security checks for vulnerabilities and agentic risk

Overview

This logistics query skill is purpose-aligned, but it needs review because its scripts send tokens and shipment/business data while disabling TLS checks and its instructions build shell commands from user input without safe argument handling.

Review before installing or running. Use only a scoped, revocable JD/Ochama token, avoid storing it in a generic home-directory .env file, and run the skill in a restricted environment. The publisher should remove rejectUnauthorized:false, validate and pass command arguments through a non-shell API, standardize credential setup, and disclose that shipment IDs and business metrics are sent to external JD/Ochama services.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: skills/joy-logistics-indicator/SKILL.md:161
Finding: Shell Command Injection Through Unquoted User-Controlled Arguments
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: skills/joy-logistics-indicator/scripts/get_isc_data.js:39
Finding: TLS Certificate Verification Disabled for Authenticated API Requests
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: README.md:28
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Note

Location: README.md:35
Finding: Inconsistent Credential Configuration and Insecure Secret-Storage Guidance
Content: View full analysis
~/.env << 'EOF' # 京东物流 API 配置 api_key=66Pi3xz*******yzNHvRNJgeJsqtSkn7fcJ4 EOF ``` The Windows instructions instead configure `token`: ```powershell [Environment]::SetEnvironmentVariable("token", "66Pi3xz*******yzNHvRNJgeJsqtSkn7fcJ4", "User") ``` All executable scripts read only `process.env.token`: ```javascript const https = require('https'); const token = process.env.token; ``` The cross-border script also emits a misleading error referring to a disabled dotenv-loading mechanism: ```javascript const token = process.env.token; if (!token) { console.error('❌ 未从 ~/.env 读取到 joy_token'); process.exit(1); } ``` ### Technical Analysis The documented Linux/macOS variable name does not match the variable consumed by the code. The scripts do not load `~/.env`, so merely writing `api_key` to that file does not populate `process.env.token`. The cross-border script's error message claims that `joy_token` was not read from `~/.env`, even though the relevant file-loading code is commented out and the active code reads `token`. The guidance also stores a credential in a generic home-directory dotenv file without documenting restrictive file permissions. Such shared files can be accidentally read by unrelated tools, included in support output, or exposed by permissive filesystem settings. ### Attack Path 1. A user follows the Linux/macOS setup instructions and writes the credential as `api_key` in `~/.env`. 2. The scripts read `process.env.token` ...[truncated 881 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Behavioral ASTexec() Call, eval() Call, Dynamic Import

Findings (29)

Credential Access

High

Category: Privilege Escalation
Confidence: 97% confidence
Finding: The documentation includes credential setup instructions centered on an API key, which is directly related to credential handling and could enable unauthorized API access if the token is exposed. The logistics context increases sensitivity because exposed credentials may allow access to shipment tracking data or operational metrics, potentially exposing business or customer information.
Content: Scanner excerpt · README.md (reported line 39)May include surrounding context.
MAC/Linux

bash
cat > ~/.env << 'EOF' # 京东物流 API 配置 api_key=66Pi3xz*******yzNHvRNJgeJsqtSkn7fcJ4 EOF

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The code’s actual behavior is narrowly focused on logistics tracking: it reads tracking/reference numbers, constructs a referenceList, and calls /global/trackingOpenExport/queryTrackingBatch to fetch tracking data. This aligns with the first declared module (international logistics trajectory/tracking), but not with the broader declared description that presents the skill as supporting three major function modules, including extensive supply-chain KPI queries and cross-border small-package experience metrics. Since the supplied code chunk does not implement those additional declared capabilities, the description overstates what this code actually does. There are no obvious undeclared malicious or unrelated behaviors beyond making the tracking API request.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 13)May include surrounding context.
js
const fs = require('fs'); const path = require('path'); // 自动从 ~/.env 读取 joy_token // let token = ''; // try { // const envPath = path.join(process.env.HOME, '.env');

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 26)May include surrounding context.
js
const fs = require('fs'); const path = require('path'); // 自动从 ~/.env 读取 joy_token // let token = ''; // try { // const envPath = path.join(process.env.HOME, '.env');

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · skills/joy-logistics-indicator/scripts/get_cross_board_data.js (reported line 16)May include surrounding context.
js
// 自动从 ~/.env 读取 joy_token // let token = ''; // try { // const envPath = path.join(process.env.HOME, '.env'); // const envContent = fs.readFileSync(envPath, 'utf8'); // const match = envContent.match(/^joy_token=(.+)$/m); // if (match) token = match[1].trim();

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The HTTPS request explicitly sets rejectUnauthorized: false, which disables TLS certificate validation. This allows a man-in-the-middle attacker to intercept or modify requests and responses, exposing the token header and potentially altering logistics or indicator data returned to the skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Disabling certificate verification without any warning means the script silently operates over an unauthenticated TLS channel. Users and operators may believe the connection is secure while credentials and data are vulnerable to interception or tampering.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code sets rejectUnauthorized: false on an HTTPS request, which disables TLS certificate verification and allows man-in-the-middle interception or impersonation of us-api.jd.com. Because this script sends an authentication token and queries potentially sensitive logistics and operational indicator data, an attacker on the network path could steal credentials, alter responses, or inject false business data.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: This finding refers to the same behavior: outbound HTTPS certificate validation is explicitly disabled with no warning, making the connection unauthenticated despite using TLS. In this skill's context, the request includes a token header and accesses logistics/indicator data, so intercepted traffic could expose secrets and permit tampering with operational outputs consumed by users or downstream systems.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README instructs users to place an API credential in a local ~/.env or user environment variable without any guidance on secret hygiene, least privilege, rotation, or avoiding accidental exposure through shell history, backups, or shared machines. Even though this is documentation rather than executable code, it normalizes insecure secret handling and can lead to credential leakage.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill is presented entirely in Chinese and its required user prompts and fixed return messages are specified only in Chinese, with no indication that users may choose another language. This creates a natural-language locale constraint that is not presented as optional or justified as a region-specific compliance requirement.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The trigger description says to use the skill whenever a user needs to query warehouse-related indicator data, and also covers broad comparison, ranking, and best/worst requests across multiple dimensions. It does not define exclusion conditions or negative examples, so similar everyday analytic requests could overlap unintentionally with other skills.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The skill requires shell command execution with user-influenced parameters but provides no safety constraints, escaping rules, or trust boundary discussion. In an agent setting, this increases the chance that natural-language input is transformed into unsafe subprocess arguments or that execution occurs without appropriate user awareness and sandboxing.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The instruction to check environment variables before query execution encourages access to sensitive configuration without defining limits or masking requirements. In a query-only skill, this broadens the attack surface and may expose credentials, endpoints, or other secrets if the agent surfaces them or uses them outside intended controls.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill explicitly instructs the agent to check environment variables before performing a cross-border metrics query, even though the documented task is data retrieval. Accessing environment variables expands scope into sensitive runtime configuration and can expose secrets or enable unintended disclosure if the agent reflects or mishandles that information.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The cross-border section directs the agent to execute a command-line script using parsed user input, again without safety controls or explicit sandbox assumptions. Even though argument order is constrained, untrusted input flowing into subprocess execution can still be dangerous if the surrounding runner uses shell evaluation or if downstream scripts are not hardened.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: One mandatory rule says that when no matching data exists, the response must be exactly '未查询到指标数据，请检查查询条件是否正确'. Later, the dedicated empty-result section instructs returning a different fixed message: '该客户不存在或者没有全程履约率'. These are mutually incompatible directives for the same case.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The manifest describes a business-query skill for logistics tracking and indicator retrieval, but does not justify local environment inspection for credentials as part of its user-facing purpose. Reading a process environment variable to obtain an access token is an additional capability outside the stated functional scope, even though it is used to authenticate later API calls.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs sending shipment and order identifiers to an external JD logistics API, but it does not warn the user that their identifiers will leave the local agent context. These identifiers may be sensitive business or customer data, so the lack of disclosure undermines informed consent and can cause privacy or compliance issues, especially in enterprise settings.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The output section mandates fixed Chinese phrasing such as '物流轨迹详情' and '查询结果：物流单号 {单号} 未查询到物流轨迹', which constrains the response language. There is no indication that the user can opt into another language or that the locale restriction is justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The request payload hard-codes the locale to "zh-CN", which imposes a specific language/locale behavior on all users. The file does not provide any user opt-in, configuration path, or comment explaining that this skill is intentionally region-specific.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script explicitly sets rejectUnauthorized to false, disabling TLS certificate validation for an HTTPS request carrying an authentication token and potentially sensitive logistics data. This enables man-in-the-middle interception or response tampering by any attacker able to influence the network path, which is especially dangerous in a logistics-query skill that depends on trusted upstream data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README presents all user-facing instructions in Chinese and does not offer an alternate language or state that the skill is intentionally limited to Chinese-speaking users. This can violate a language/locale policy when a specific language is effectively forced without user choice or documented justification.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest declares the skill as iplat-test-skill focused on 京东国际物流数据查询, but the body documentation describes joy-logistics-skill as a complete collection of multiple logistics skills. This is an active documentation/code-intent mismatch within the same file because the inline documentation identifies a different skill package and scope than the declared manifest.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.