ClawHub
Back to skill

Security audit

Express Logistics Track - 快递物流查询

Security checks across malware telemetry and agentic risk

Overview

This skill checks package tracking through JisuAPI and does not show hidden, destructive, or unrelated behavior.

Install only if you are comfortable sending shipment identifiers, and sometimes the last four digits of a phone number, to JisuAPI. Use a dedicated Jisu API key where possible and confirm the Python requests package is installed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
79% confidence
Finding
The trigger description is broad enough to overlap with ordinary user language about package status, which can cause unintended invocation of the skill. In context, that means shipment numbers and possibly phone suffixes could be sent to a third-party logistics API when the user did not clearly consent to using this specific external integration.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The documentation instructs the agent to transmit tracking numbers and, for some carriers, the last four digits of a phone number to a third-party API, but it does not provide a clear privacy notice or consent boundary. Tracking numbers and phone suffixes are sensitive personal/shipping data, and silent transmission increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill sends the user's tracking number and optional mobile suffix to a third-party logistics API, which is an external data disclosure event. While this is functionally necessary for courier lookup, the privacy risk is real because these identifiers can reveal shipment activity and may be sensitive personal data if sent without clear user notice or consent.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.