Package Tracker

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:02 PM UTC
• Version: 1.0.0

Overview

This looks like a legitimate package tracker, but its install path and setup process create review-worthy supply-chain and credential-handling risks.

Review before installing. Prefer installing from a pinned commit or signed release, pin dependencies, restrict the .env file to the current user, avoid entering Telegram credentials unless the integration actually needs them, and treat shipment updates relayed from carriers as untrusted text.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T03 · Remote Payload Retrieval and Execution

Error

• Location: README.md:24

Finding

Mutable Remote Repository Is Cloned and Its Setup Script Is Executed

Content

View full analysis

Remediation

View remediation

``` 2. Prefer signed release archives instead of the mutable default branch. 3. Publish SHA-256 checksums and cryptographic signatures for release artifacts. 4. Require verification of the commit signature or artifact checksum before running setup. 5. Do not instruct an Agent to clone and execute code in one unconstrained operation. Separate retrieval, review, verification, and execution. 6. Run setup as an unprivileged dedicated account with minimal filesystem and network access. ]]>

T08 · Insecure Dependencies

Warning

• Location: scripts/setup.sh:29

Finding

Unpinned Dependencies and Unconditional Package-Installer Upgrade

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup.sh:36

Finding

Credential File Is Created Without Explicitly Restrictive Permissions

Content

View full analysis

"$SCRIPT_DIR/.env" << 'EOF' # 17track API key — Get yours free at https://admin.17track.net # Free tier: 100 tracking registrations/month, unlimited status checks SEVENTEEN_TRACK_API_KEY= # Telegram notifications (optional) # Create a bot via @BotFather, get chat ID via @userinfobot TELEGRAM_BOT_TOKEN= TELEGRAM_CHAT_ID= EOF echo "✅ Created .env template — edit scripts/.env to add your API keys" else ``` ### Technical Analysis The setup script creates `scripts/.env` without setting a restrictive `umask` and without applying an explicit mode such as `0600`. The resulting permissions depend on the caller's environment. With a common permissive umask, the file may be readable by other local users after credentials are entered. The file is intended to hold the 17track API key and also includes Telegram bot credentials. The audited implementation does not use the Telegram fields, making their collection unnecessary for the declared implementation and contrary to data minimization. No credentials are hardcoded in the distributed template. The vulnerability concerns the permissions of secrets entered later. ### Attack Path 1. Setup creates `scripts/.env` under the caller's current umask. 2. The user enters a 17track API key or optional Telegram credentials. 3. The resulting file remains readable by a broader local group or other users. 4. Another local account, compromised process, backup job, or shared-workspace participant reads the file. 5. The exposed credentials are used against 17track or Telegram. ### Impact Assessment Exposure of the 17track API key could allow an attacker to consume quota, query API resources permitted by the key, or interfere with tracking operat ...[truncated 445 chars]

Remediation

View remediation

"$SCRIPT_DIR/.env" <<'EOF' SEVENTEEN_TRACK_API_KEY= EOF ) ``` 2. Explicitly enforce permissions after creation: ```bash chmod 600 "$SCRIPT_DIR/.env" ``` 3. Verify that the containing directories are not writable by untrusted users. 4. Remove `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID` until direct Telegram support actually exists. 5. Add `.env` to `.gitignore` and prevent credentials from entering source control or diagnostic archives. 6. Prefer an operating-system secret store or OpenClaw-managed credential facility where available. 7. Document credential rotation procedures in case the file is exposed. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/tracker.py:272

Finding

Untrusted Carrier Event Data Is Printed Without Terminal or Agent-Output Sanitization

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation

Findings (27)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 79)May include surrounding context.

python scripts/cli.py remove "TRACKING_NUMBER"

text

Deactivates tracking (does not delete history).

### Check API Quota

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 35)May include surrounding context.

sh

"$SCRIPT_DIR/venv/bin/pip" install -q -r "$SCRIPT_DIR/requirements.txt"
echo "✅ Dependencies installed"

# Create .env template if it doesn't exist
if [ ! -f "$SCRIPT_DIR/.env" ]; then
    cat > "$SCRIPT_DIR/.env" << 'EOF'
# 17track API key — Get yours free at https://admin.17track.net

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 47)May include surrounding context.

sh

"$SCRIPT_DIR/venv/bin/pip" install -q -r "$SCRIPT_DIR/requirements.txt"
echo "✅ Dependencies installed"

# Create .env template if it doesn't exist
if [ ! -f "$SCRIPT_DIR/.env" ]; then
    cat > "$SCRIPT_DIR/.env" << 'EOF'
# 17track API key — Get yours free at https://admin.17track.net

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 49)May include surrounding context.

sh

"$SCRIPT_DIR/venv/bin/pip" install -q -r "$SCRIPT_DIR/requirements.txt"
echo "✅ Dependencies installed"

# Create .env template if it doesn't exist
if [ ! -f "$SCRIPT_DIR/.env" ]; then
    cat > "$SCRIPT_DIR/.env" << 'EOF'
# 17track API key — Get yours free at https://admin.17track.net

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 56)May include surrounding context.

sh

"$SCRIPT_DIR/venv/bin/pip" install -q -r "$SCRIPT_DIR/requirements.txt"
echo "✅ Dependencies installed"

# Create .env template if it doesn't exist
if [ ! -f "$SCRIPT_DIR/.env" ]; then
    cat > "$SCRIPT_DIR/.env" << 'EOF'
# 17track API key — Get yours free at https://admin.17track.net

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 36)May include surrounding context.

sh

# ── Config ──────────────────────────────────────────────────────────

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
load_dotenv(os.path.join(BASE_DIR, ".env"))

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 37)May include surrounding context.

sh

# ── Config ──────────────────────────────────────────────────────────

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
load_dotenv(os.path.join(BASE_DIR, ".env"))

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tracker.py (reported line 18)May include surrounding context.

python

# ── Config ──────────────────────────────────────────────────────────

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
load_dotenv(os.path.join(BASE_DIR, ".env"))

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/tracker.py (reported line 173)May include surrounding context.

python

# ── Config ──────────────────────────────────────────────────────────

BASE_DIR = os.path.dirname(os.path.abspath(__file__))
load_dotenv(os.path.join(BASE_DIR, ".env"))

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The README states that package tracking is performed through the 17track API, which implies tracking numbers and shipment metadata are sent to a third party, but it does not clearly foreground this as a privacy consideration near the feature description or setup flow. Users may disclose sensitive shipment information without understanding that external processing occurs.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The quick-start text instructs users to 'install the package tracker skill' by cloning and running setup, which is a broad trigger phrase that can encourage an agent to perform multi-step code acquisition and execution with limited user confirmation. In an agent ecosystem, this increases the chance of unintended repository cloning or script execution when a user asks for package tracking help.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 80% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 107)May include surrounding context.

Automatic Updates with Cron

Add a cron job to check for updates automatically:

bash

# Check every hour

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README explains that tracking updates are relayed to messaging channels such as Telegram, Signal, Discord, and WhatsApp, but it does not clearly warn that shipment status and potentially identifying descriptions may be forwarded to external communication services. This can expose sensitive logistics information to additional third parties or unintended recipients if channels are misconfigured.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill documentation describes capabilities that require environment access and outbound network access, but it does not declare any explicit tool scope or permissions. This creates a trust and review gap: an agent may invoke the skill with broader privileges than intended, exposing API keys in the environment or allowing uncontrolled external requests to the 17track service.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · references/17track-api.md (reported line 107)May include surrounding context.

md

## Rate Limits

- **Free tier:** 100 registrations/month
- **gettrackinfo:** No limit on calls (only registered numbers work)
- **Batch size:** Up to 40 numbers per gettrackinfo call
- **Recommended polling interval:** Every 2-4 hours for active packages

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/17track-api.md (reported line 8)May include surrounding context.

md

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

API_BASE = "https://api.17track.net/track/v2.2"
DB_PATH = os.path.join(BASE_DIR, "data", "tracker.db")

# ── Status mapping ──────────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/17track-api.md (reported line 124)May include surrounding context.

md

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

API_BASE = "https://api.17track.net/track/v2.2"
DB_PATH = os.path.join(BASE_DIR, "data", "tracker.db")

# ── Status mapping ──────────────────────────────────────────────────

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/tracker.py (reported line 22)May include surrounding context.

python

API_KEY = os.getenv("SEVENTEEN_TRACK_API_KEY", "")

API_BASE = "https://api.17track.net/track/v2.2"
DB_PATH = os.path.join(BASE_DIR, "data", "tracker.db")

# ── Status mapping ──────────────────────────────────────────────────

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

Tracking numbers are transmitted to the third-party 17track API, which can expose shipment identifiers and related logistics metadata to an external service. In an agent setting, this is risky if users are not clearly informed that their package data leaves the local environment and is subject to third-party handling.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · scripts/tracker.py (reported line 218)May include surrounding context.

python

def get_track_info(tracking_numbers: list[str]) -> dict:
    """Get tracking info for registered numbers (free, unlimited calls)."""
    _check_api_key()
    payload = [{"number": tn} for tn in tracking_numbers]
    with httpx.Client(timeout=30) as client:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The notification formatter and check_updates flow indicate that tracking numbers, status, descriptions, locations, and dates will be relayed through messaging platforms such as Telegram, Signal, Discord, or WhatsApp. This is a privacy-relevant disclosure of shipment data, but the code provides no confirmation step or direct user warning when these notifications are emitted.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency httpx is unpinned, so installs may resolve to different versions over time, reducing build reproducibility and making it impossible to verify whether a safe or vulnerable release is deployed. In a package-tracking skill that makes outbound API calls, this increases supply-chain risk and complicates patch and incident response.

Content

Scanner excerpt · scripts/requirements.txt (reported line 1)May include surrounding context.

text

httpx
python-dotenv

Unverifiable Dependency: httpx has 2 known advisory(ies) (CVE-2021-41945 (Improper Input Validation in httpx); CVE-2021-41945 (Encode OSS httpx <=1.0.0.beta0 is affected by improper input validation in `http)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

httpx has known advisories, and because no version is pinned, there is no way to determine from this manifest whether the deployed package is affected. In a network-facing integration like a shipment tracker, unresolved client-library versions increase uncertainty around request-handling and input-validation weaknesses.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 96% confidence

Finding

The dependency python-dotenv is unpinned, which allows different versions to be installed in different environments and makes security posture unverifiable. Because this library influences environment-variable loading, unexpected version changes could affect configuration handling and exposure to known package issues.

Content

Scanner excerpt · scripts/requirements.txt (reported line 2)May include surrounding context.

text

httpx
python-dotenv

Unverifiable Dependency: python-dotenv has 2 known advisory(ies) (CVE-2026-28684 (python-dotenv: Symlink following in set_key allows arbitrary file overwrite via ); CVE-2026-28684 (python-dotenv reads key-value pairs from a .env file and can set them as environ)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 89% confidence

Finding

python-dotenv has known advisories, and the unpinned manifest prevents verification that a non-vulnerable version will be installed. Since dotenv libraries can affect filesystem and configuration behavior, this uncertainty is a real supply-chain and deployment-hardening issue even if the file alone does not prove exploitability.

Content

No source excerpt is available for this finding.