Parcel Station Route Qr

• Outcome: Review
• Latest audit: May 28, 2026, 9:10 AM
• Version:
  1.0.0

Overview

The skill mostly matches a parcel-station QR chatbot, but it bundles an unrelated Notion sync script that reads local credentials and sends data to Notion without disclosure.

Review this skill before installing. The parcel-station route and QR instructions are coherent, but the package should remove or clearly document the unrelated Notion sync script, including what credentials it reads and what data it sends. If used, add a QR confirmation step before sending decoded content and only bypass self-signed certificate warnings for local development on a trusted network.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: This file is a standalone Notion synchronization CLI that is unrelated to the declared parcel-station route guidance and QR scanning functionality. In a skill package, unrelated code that reads local secrets and syncs user content externally materially increases supply-chain risk because it expands capabilities beyond the stated purpose and could be used to exfiltrate operational or user data.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code reads Notion credentials from local config files and uses them to make authenticated external API calls, despite no clear connection to the skill's stated purpose. This creates an unjustified secret-access and outbound-network capability that could expose locally stored credentials and transmit user or operational data to a third party without appropriate scope limitation.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The QR workflow explicitly says decoded content is automatically sent after scanning, without a review or confirmation step. QR codes can encode malicious URLs, prompt-injection text, or unintended commands, so auto-submission increases the chance of phishing, unsafe navigation, or injection into the chatbot context.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The instructions tell users to click through a self-signed certificate warning without clearly explaining the trust and MITM risks. Training users to bypass browser TLS warnings normalizes unsafe behavior and could lead them to ignore legitimate certificate attacks in other contexts.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: Reading API keys and database identifiers from a user's local configuration without any user-facing disclosure is a privacy and trust violation, especially inside a skill whose advertised purpose does not mention Notion integration. Even if the files are expected in a developer environment, bundling this behavior in the skill broadens access to sensitive local material without transparency.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The function sends user-provided title/content and related metadata to the Notion API over the network without any explicit privacy notice, consent flow, or indication in the skill description that external transmission occurs. In context, this is more dangerous because users of a parcel-station route/QR skill would not reasonably expect their inputs to be synced to a third-party note service.

VirusTotal

VirusTotal findings are pending for this skill version.