ClawHub
Back to skill

Security audit

Global Package Tracking - 全球物流快递查询

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent parcel-tracking skill, but users should know it sends tracking details and the Juhe API key to Juhe for lookup.

Install only if you are comfortable sending parcel identifiers, courier codes, your Juhe API key, and sometimes a 4-digit phone suffix to Juhe. Prefer the environment variable over CLI arguments, keep any scripts/.env file out of version control, and provide phone suffixes only when the courier requires them.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/express_track.py:136
Finding

Sensitive credentials and shipment data transmitted in URL query parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_EXPRESS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_EXPRESS_KEY=your_api_key
    3. 直接传参: python express_track.py --key your_api_key <快递单号> --com <公司>

免费申请 API Key: https://www.juhe.cn/docs/api/id/43

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_EXPRESS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_EXPRESS_KEY=your_api_key
    3. 直接传参: python express_track.py --key your_api_key <快递单号> --com <公司>

免费申请 API Key: https://www.juhe.cn/docs/api/id/43

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/express_track.py (reported line 21)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_EXPRESS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_EXPRESS_KEY=your_api_key
    3. 直接传参: python express_track.py --key your_api_key <快递单号> --com <公司>

免费申请 API Key: https://www.juhe.cn/docs/api/id/43

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/express_track.py (reported line 406)May include surrounding context.

python
API Key 配置（任选其一，优先级从高到低）:
    1. 环境变量: export JUHE_EXPRESS_KEY=your_api_key
    2. 脚本同目录的 .env 文件: JUHE_EXPRESS_KEY=your_api_key
    3. 直接传参: python express_track.py --key your_api_key <快递单号> --com <公司>

免费申请 API Key: https://www.juhe.cn/docs/api/id/43

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/express_track.py (reported line 74)May include surrounding context.

python
env_key = os.environ.get("JUHE_EXPRESS_KEY", "").strip()
    if env_key:
        return env_key
    env_file = Path(__file__).parent / ".env"
    if env_file.exists():
        for line in env_file.read_text(encoding="utf-8").splitlines():
            line = line.strip()

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
86% confidence
Finding

The skill declares capabilities that imply environment access, local file reads, and outbound network use, but it does not explicitly scope or constrain those permissions in the manifest. This weakens the trust boundary for the agent/runtime because users and reviewers cannot easily verify what resources the skill is allowed to access, increasing the chance of over-privileged execution.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The trigger phrases are broad everyday language such as asking where a package is, which can cause the skill to activate in contexts where the user did not intend third-party tracking lookups. In an agent ecosystem, overbroad invocation can lead to unnecessary handling of tracking numbers and related personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The documentation instructs users to send tracking numbers and, for some couriers, the last four digits of sender or receiver phone numbers to a third-party API, but it does not provide a clear privacy warning or data-sharing notice. Tracking data and phone suffixes are sensitive logistics metadata and their transmission to an external provider creates privacy and compliance risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The script sends a tracking number and optionally the sender/receiver phone last 4 digits to a third-party API, but it does not provide an explicit privacy notice at the point of collection or transmission. While this is necessary for the feature, users may not understand that potentially sensitive shipment metadata is being disclosed to an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The manifest sentence '快递公司编号本地解析无需额外请求' is framed as part of how the skill works, emphasizing local resolution without additional requests. Later documentation explicitly includes a direct external API call pattern to juhe.cn for the actual lookup, so the wording can mislead readers into thinking the whole company-identification/query flow is offline except where in fact the tracking result itself is obtained remotely.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

This JSON contains natural-language fields and values predominantly in Chinese, including the top-level status message and most courier names. For a general reference file, this imposes a specific language/locale without any visible opt-in or justification in the file itself.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

The natural-language instructions, usage, and warnings in this file are exclusively in Chinese. Under the policy, forcing a specific language without user opt-in can be a locale/language policy violation when no alternative language option or justification is provided.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.