Security audit

kuaidi100-user

Security checks for vulnerabilities and agentic risk

Overview

This shipping skill is mostly purpose-aligned, but it asks agents to install and use a mutable global CLI with sensitive shipping data and gives unsafe command templates for user-supplied fields.

Install only if you trust the @kuaidi100-user/cli package source and are comfortable with a global CLI handling shipping PII and login state. Prefer a pinned, reviewed CLI version, use safe argument-array execution rather than interpolated shell strings, require explicit confirmation before cancellations, and avoid unauthenticated access to local cached order data unless you understand what is stored locally.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:19
Finding: Unpinned Global Installation of a Third-Party CLI Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:131
Finding: Shell Command Injection Risk from Unquoted User-Controlled CLI Arguments
Content: View full analysis
--sender-phone \ --sender-province --sender-city --sender-district --sender-address \ --receiver-name --receiver-phone \ --receiver-province --receiver-city --receiver-district --receiver-address \ --item-name --weight \ --kuaidi-name --kuaidi-com --company-sign \ [--service-type ] [--estimated-amount ] [--remark ] [--expected-pickup-time-desc ] ``` Related command templates similarly place user-originated values directly into commands, including address input, recipient names, cancellation reasons, and local JSON data. ### Technical Analysis The documented templates interpolate names, telephone numbers, addresses, item names, remarks, and other values into command lines without requiring an argument-array execution API, shell escaping, validation, or an end-of-options delimiter. Several of these values originate directly from user conversation. If an Agent constructs a command string by replacing the placeholders and passes that string to a shell, shell metacharacters can be interpreted as syntax rather than literal argument data. Relevant syntax may include command separators, pipelines, redirections, command substitutions, environment expansions, and newline characters. Values beginning with a hyphen may also be interpreted as unintended CLI options. Even where shell command execution is avoided, this can cause argument injection unless the CLI supports and uses an end-of-options marker or validates each field. The issue is especially significant because the S ...[truncated 2077 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest description frames this as a user shipping assistant that must use SSO plus server-side address book for shipping and forbids local cache use. However, the documented capability set includes commands to view, set, and clear local sender/receiver/order data, including modifying local cached personal data. While partially caveated, this is broader than the manifest's stated operational model and introduces behavior the description does not clearly justify.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says unauthenticated users should only have access to helper functions, but the skill later allows logistics queries from local cached orders while unauthenticated. That widens access to potentially sensitive shipment metadata without login, which can expose tracking numbers, addresses, or order history to anyone with local environment access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill documents order cancellation as a simple command flow without an explicit confirmation safeguard or warning about irreversible business impact. In an agent setting, destructive actions need stronger guardrails because a misunderstood request or hallucinated order number could cancel a legitimate shipment.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The workflow instructs sending sensitive personal data—names, phone numbers, and detailed addresses—to remote services for address parsing, pricing, and order creation without requiring any explicit user-facing notice or consent checkpoint. In a shipping skill, such transmission is expected, but silently forwarding third-party recipient data increases privacy and compliance risk, especially when the user may not realize which fields are being sent to which backend operations.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The document repeatedly states that in logged-in mode, order management should use only server-side data and avoid local-cache fallbacks. However, the cancellation workflow says that after a successful kd100 order cancel, the agent should mark status in local cache, which contradicts the earlier '仅服务端' / '不展示本地缓存' guidance for logged-in order management.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The skill explains that kd100 auth login --open will launch the system's external browser, and later says a browser tool may optionally auto-open the order link. While operationally clear, it does not explicitly warn users that external browser launch may expose session context to another application or change system state by opening URLs outside the agent environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: The documentation repeatedly emphasizes that local cache must not be used in shipping-related flows, but then introduces local data management and local-order lookup pathways adjacent to those flows. Because the skill is a procedural operator guide, this mixed guidance can mislead an agent about whether local cached data is acceptable in practice. The contradiction is intent-level rather than a minor omission.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.