Security audit

租赁-货找船

Security checks for vulnerabilities and agentic risk

Overview

The skill does the vessel-matching job it describes, but it handles commercially sensitive cargo demand data and public contact details with weak scoping and persistence controls.

Review this skill before installing in any shared or production environment. Configure the backend endpoint deliberately, tell users that cargo demand details may be sent or queued locally, restrict the uvicorn service to trusted networks or localhost unless protected by authentication, and clean or protect the cache/outbox directories.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill instructs the agent to execute local Python scripts, expose a network service, read configuration, cache data, and potentially write demand records, yet it declares no permissions. This creates a mismatch between stated and actual capabilities, reducing review visibility and increasing the chance the skill can access local resources or external services without appropriate sandboxing or user awareness.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The document specifies sending identifiable user demand data and shipment details to a backend API, but it does not mention any user notice, consent, or transparency requirement. In this skill context, the data includes user ID, ports, cargo type, tonnage, and loading date, which can reveal commercially sensitive shipping activity and create privacy/compliance risk if users are unaware of the sync.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback behavior stores unsent demand records in a local JSONL file without any warning that sensitive business data may be written to disk. In this context, cargo requests and routing details are commercially sensitive, and local persistence increases exposure through unauthorized host access, weak filesystem permissions, backups, or later unintended reuse.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: When sync_demand_record is enabled and user_id is present, the function transmits user and cargo shipment data to sync_demand(...) without any visible consent, notice, minimization, or policy enforcement in this file. In a skill handling commercial shipping requests, this can leak sensitive business information such as user identity, route, cargo type, tonnage, and schedule to another system, creating privacy and confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The /vessel/{solid} JSON endpoint and /vessel/{solid}/view HTML endpoint expose personal and contact data fields such as mobile number, telephone, WeChat/QQ, and email with no authentication, authorization, rate limiting, or consent/disclosure checks visible in this file. In the context of a vessel-finding skill, these endpoints can enable scraping and bulk harvesting of broker/contact information, creating privacy, spam, and targeted social-engineering risk even if the source data was obtained from an upstream service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code fetches vessel detail pages, extracts contact fields such as mobile, telephone, email, WeChat/QQ, and contact name, then stores the resulting detail object on disk via write_json_atomic. Persisting third-party personal/contact data without any access control, minimization, retention guardrails, or user disclosure increases privacy and compliance risk, especially if cache files are readable by other users/processes or retained longer than necessary.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.