云途物流 & 燕文物流 Shipping

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:10 AM UTC
• Version: 1.0.1

Overview

The skill appears to be a real shipping helper, but it can send carrier credentials and parcel data over insecure or insufficiently restricted API destinations.

Install only with caution. Do not use production credentials unless you can ensure HTTPS and official carrier hosts, keep the generated env files private with restrictive permissions, and review every --execute action because it can change real carrier account or shipment state.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (5)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/yunexpress_shipping.py:84

Finding

YunExpress API credentials and shipment data are transmitted over plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/yunexpress_shipping.py:84

Finding

Unrestricted configurable API destinations can receive carrier authentication material and shipment payloads

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yanwen_shipping.py:49

Finding

Yanwen tracking sends merchant and parcel identifiers over plaintext HTTP

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/yunexpress_shipping.py:131

Finding

Carrier API responses are printed without comprehensive personal-data redaction

Content

View full analysis

= 400 or (isinstance(data, dict) and data.get("Code") not in (None, "0000")): sys.exit(1) ``` Yanwen omits only one specific Base64 label field before printing everything else: ```python def output(status, payload): if isinstance(payload, dict) and isinstance(payload.get("data"), dict) and "base64String" in payload["data"]: data = dict(payload["data"]); data["base64String"] = f"[omitted: {len(data['base64String'] or '')} characters]"; payload = dict(payload, data=data) print(json.dumps({"http_status": status, "response": payload}, ensure_ascii=False, indent=2)) if status >= 400 or (isinstance(payload, dict) and not payload.get("success", False)): sys.exit(1) ``` ### Technical Analysis The clients implement recursive redaction for write previews, but that redaction is not applied to API responses. YunExpress outputs complete response objects. Yanwen protects only a specifically located `base64String`. Order lookup, tracking, label, PCCC verification, and carrier error responses can contain recipient names, addresses, phone numbers, email addresses, customs identifiers, tracking numbers, order numbers, and carrier contact details. In an Agent context, stdout can be displayed to the caller, captured in conversation history, or retained by runtime logs. This conflicts with the Skill's own output rules, which require personal information and identifiers to be redacted in summaries. ### Attack Path 1. A user requests an order lookup, tracking query, label operation, or identity/customs verification. 2. The carrier returns a ...[truncated 780 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/yunexpress_shipping.py:108

Finding

Credential environment templates are created without enforcing restrictive file permissions

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

If the skill exposes additional write actions such as IOSS changes, subscription management, CPSC filings, or direct execution of state-changing YunExpress operations beyond what users are told, that is a material security and integrity issue. Hidden or under-described write capabilities can alter carrier account state, compliance settings, or shipment data under trusted merchant credentials.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

If the skill exposes additional write actions such as IOSS changes, subscription management, CPSC filings, or direct execution of state-changing YunExpress operations beyond what users are told, that is a material security and integrity issue. Hidden or under-described write capabilities can alter carrier account state, compliance settings, or shipment data under trusted merchant credentials.

Content

No source excerpt is available for this finding.

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

Use `--help` to list all supported operations. `post` prints a redacted preview for a write until `--execute` is present. It sends JSON with UTF-8, derives `Authorization: Basic` from `Base64(customer-code & API-secret)`, and never logs that token.

## Output rules

- Quote results: compare service code/name, total fee, currency, billable weight, tracking availability, goods type, and delivery days; label prices as a point-in-time API result.
- Shipment preview: include order count (maximum 10 per create request), destination, selected product code, weight/dimensions, declared goods, optional services, and validation errors. Do not display full street addresses, phone numbers, emails, or credentials in chat.

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/yanwen_shipping.py (reported line 19)May include surrounding context.

python

REDACT = {"address", "address2", "phone", "email", "taxnumber", "apitoken", "authorization", "labelbase64"}

def load_env(path):
    values = dict(os.environ)
    if not path.exists(): raise ValueError(f"Env file not found: {path}. Run init-env and keep it private.")
    for line in path.read_text(encoding="utf-8").splitlines():
        if "=" in line and not line.lstrip().startswith("#"):

Env Variable Harvesting

High

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code enumerates, copies, or searches environment variables for secrets. Bulk environment access can collect credentials unrelated to the skill's stated purpose.

Content

Scanner excerpt · scripts/yunexpress_shipping.py (reported line 38)May include surrounding context.

python

REDACT = {"address", "address2", "phone", "email", "taxnumber", "apitoken", "authorization", "labelbase64"}

def load_env(path):
    values = dict(os.environ)
    if not path.exists(): raise ValueError(f"Env file not found: {path}. Run init-env and keep it private.")
    for line in path.read_text(encoding="utf-8").splitlines():
        if "=" in line and not line.lstrip().startswith("#"):

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill declares access to secrets, local files, and networked carrier APIs but does not define an explicit tool/permission scope. That omission weakens containment and review because the skill can read env vars, write payload files, and make authenticated external requests without machine-readable restrictions on what tools are allowed.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 98% confidence

Finding

The documented tracking base URL uses HTTP instead of HTTPS, creating cleartext transmission risk for requests that include tracking numbers and Authorization data. An attacker on the network path could observe or tamper with shipment lookups, exposing customer parcel information and potentially compromising the shipping account.

Content

Scanner excerpt · references/yanwen-api.md (reported line 7)May include surrounding context.

md

- Production order API: `https://open.yw56.com.cn/api/order`
- Test order API: `https://open-fat.yw56.com.cn/api/order`
- Tracking API: `http://api.track.yw56.com.cn/api/tracking`

Use this reference with `scripts/yanwen_shipping.py`. Yanwen order APIs use POST and UTF-8 JSON. Put `user_id`, `method`, `format=json`, millisecond `timestamp`, `version=V1.0`, and `sign` in the query string; send compact JSON as the body. The signature is lowercase MD5 of `apiToken + user_id + compact-data + format + method + timestamp + version + apiToken`. A normal successful response has `success: true` and `code: "0"`.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 99% confidence

Finding

This section explicitly instructs clients to send up to 30 parcel numbers to an HTTP tracking URL with the shipping account in the Authorization header, which is a direct credential-and-PII exposure pattern. Because the endpoint can return final-mile carrier and checkpoint details, interception would leak operational and customer delivery data and may allow unauthorized querying if credentials are reused.

Content

Scanner excerpt · references/yanwen-api.md (reported line 52)May include surrounding context.

md

## Tracking and status

Track up to 30 Yanwen or final-mile numbers with `GET http://api.track.yw56.com.cn/api/tracking?nums=...` and the shipping account in `Authorization`. Responses can include Yanwen number, final-mile number/carrier, carrier site/contact, checkpoints, and layered status. Key final-mile checkpoints: `LM25` out for delivery, `LM30` ready for pickup, `LM40` delivered, `LM50` failed delivery, `LM90` returned. Package-level state 1 means no result, 2 label created, 3 in transit, 4 delivery in progress, 5 ready for pickup, 6 delivered, 7 tracking ended, 8 delivery failed, 9 exception, and 0 returned.

## Failure handling

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The reference directs use of a tracking endpoint over plain HTTP while sending shipment identifiers and an Authorization credential, which exposes both metadata and credentials to interception or modification in transit. In a shipping skill, this is especially sensitive because tracking numbers, final-mile details, and account credentials can reveal customer logistics information and enable unauthorized access or tracking queries.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The code claims credentials are never printed, but output() and HTTP error handling can print carrier response bodies with only limited redaction. If the carrier echoes submitted data, authorization-related values, labels, addresses, or other sensitive fields under unexpected keys, those values may be exposed in logs or terminal output despite the safety claim.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This is a real security issue because the external transmission is to an unencrypted HTTP endpoint, not merely because data leaves the system. In this skill context, the transmission includes shipment identifiers and an Authorization header, so interception or tampering is feasible on hostile networks.

Content

Scanner excerpt · scripts/yanwen_shipping.py (reported line 51)May include surrounding context.

python

def track(env, numbers):
    if not 1 <= len(numbers.split(",")) <= 30: raise ValueError("Track 1-30 comma-separated numbers.")
    url = "http://api.track.yw56.com.cn/api/tracking?" + urlencode({"nums": numbers})
    req = Request(url, headers={"Authorization": env["YANWEN_USER_ID"]}, method="GET")
    with urlopen(req, timeout=45) as response: return response.status, json.loads(response.read().decode("utf-8"))

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tracking function sends requests to an HTTP endpoint instead of HTTPS while also attaching an Authorization header containing the Yanwen user ID. This allows network attackers or intermediaries to observe or modify tracking numbers, responses, and headers in transit, which is especially risky in a shipping skill handling merchant logistics data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The tracking request uses plain HTTP with no warning to the operator, so package numbers and the Authorization header are transmitted without transport security. Users are not informed that a supposedly safe client is downgrading confidentiality and integrity for a logistics lookup.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/yanwen_shipping.py:82

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: scripts/yunexpress_shipping.py:111