云途物流 & 燕文物流 Shipping

• Outcome: Review
• Latest audit: Jul 16, 2026 · 8:49 PM UTC
• Version: 1.0.1

Overview

The skill is a coherent shipping helper, but it handles carrier credentials and shipment data over plaintext HTTP in some paths, which needs user review before installation.

Review before installing. Use this only with merchant-approved carrier credentials, keep env files private and out of Git, and avoid Yanwen tracking or YunExpress production calls unless you accept the plaintext HTTP risk or can configure a secure carrier endpoint. Require explicit confirmation for every carrier-side write, especially cancellations, IOSS changes, subscriptions, customs/manifest actions, and CPSC submissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill documentation indicates capabilities to read/write local files, access environment variables, and make network requests, but it does not declare an explicit permissions model. That gap weakens reviewability and can cause users or orchestrators to underestimate the skill's effective access, especially because it handles shipping credentials and can perform carrier-side writes.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The stated description emphasizes tracking, quoting, lookup, and order preparation with explicit approval before writes, but the skill appears to expose broader high-impact operations such as webhook/subscription management, IOSS changes, CPSC filing, manifest/customs creation, and label uploads. This behavior expansion increases the chance of unexpected state changes, regulatory actions, or privacy-impacting integrations beyond what a user may reasonably infer from the top-level description.

Intent-Code Divergence

Medium

• Confidence: 82% confidence
• Finding: The module claims credentials are never printed, but the program prints full API responses in output() and also returns/parses HTTP error bodies without applying the redact() filter. If Yanwen returns echoed request data, PII, labels, or credential-related fields in success or error payloads, those values can be exposed to terminal logs despite the safety claim.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The tracking function sends package numbers and an Authorization header to an HTTP endpoint, so data travels without transport encryption. A network attacker can observe or modify tracking identifiers and the user ID header, which is especially risky in a shipping skill handling merchant logistics data.

External Transmission

Medium

• Category: Data Exfiltration

Content

- Production order API: `https://open.yw56.com.cn/api/order`
- Test order API: `https://open-fat.yw56.com.cn/api/order`
- Tracking API: `http://api.track.yw56.com.cn/api/tracking`

Use this reference with `scripts/yanwen_shipping.py`. Yanwen order APIs use POST and UTF-8 JSON. Put `user_id`, `method`, `format=json`, millisecond `timestamp`, `version=V1.0`, and `sign` in the query string; send compact JSON as the body. The signature is lowercase MD5 of `apiToken + user_id + compact-data + format + method + timestamp + version + apiToken`. A normal successful response has `success: true` and `code: "0"`.

• Confidence: 98% confidence
• Finding: The reference instructs the skill to use a plaintext HTTP tracking endpoint while also sending the shipping account in the Authorization header. This exposes credentials and tracking data to interception or modification by any network attacker on the path, enabling credential theft, request tampering, and package-data disclosure.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Tracking and status

Track up to 30 Yanwen or final-mile numbers with `GET http://api.track.yw56.com.cn/api/tracking?nums=...` and the shipping account in `Authorization`. Responses can include Yanwen number, final-mile number/carrier, carrier site/contact, checkpoints, and layered status. Key final-mile checkpoints: `LM25` out for delivery, `LM30` ready for pickup, `LM40` delivered, `LM50` failed delivery, `LM90` returned. Package-level state 1 means no result, 2 label created, 3 in transit, 4 delivery in progress, 5 ready for pickup, 6 delivered, 7 tracking ended, 8 delivery failed, 9 exception, and 0 returned.

## Failure handling

• Confidence: 99% confidence
• Finding: This section explicitly directs sending tracking requests over HTTP with Authorization credentials, which is insecure transport for authenticated API traffic. In the context of a logistics skill handling merchant shipping accounts and parcel identifiers, that can leak account secrets and shipment metadata and allow man-in-the-middle manipulation of responses.

External Transmission

Medium

• Category: Data Exfiltration

Content

def track(env, numbers):
    if not 1 <= len(numbers.split(",")) <= 30: raise ValueError("Track 1-30 comma-separated numbers.")
    url = "http://api.track.yw56.com.cn/api/tracking?" + urlencode({"nums": numbers})
    req = Request(url, headers={"Authorization": env["YANWEN_USER_ID"]}, method="GET")
    with urlopen(req, timeout=45) as response: return response.status, json.loads(response.read().decode("utf-8"))

• Confidence: 96% confidence
• Finding: This finding is the concrete external transmission behind the plaintext-tracking issue: the code targets http://api.track.yw56.com.cn/, causing shipment identifiers to leave the system over cleartext. Because this skill is meant for ecommerce logistics, exposed tracking data can reveal customer order activity and be tampered with in transit.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/yanwen_shipping.py:82

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/yunexpress_shipping.py:111