Security audit
Security checks for vulnerabilities and agentic risk
The skill mainly performs logistics-provider lookup, but it also under-discloses an authenticated private-message flow that can contact providers using the user's API key.
Review before installing. The public logistics search behavior is coherent, but users should treat this skill as capable of supporting authenticated outbound contact through a related messaging endpoint, not just read-only lookup. Only configure MJZJ_API_KEY if you are comfortable with agents using it for provider messaging, and require explicit confirmation of recipient and message content before any private message is sent.
The documentation claims that only two public query endpoints are exposed, but later directs use of an authenticated messaging endpoint. This mismatch weakens trust and creates a scope-confusion issue where reviewers or calling agents may underestimate the skill's ability to perform authenticated actions on behalf of a user.
Stating that the skill 'only exposes' two interfaces while later introducing a third authenticated interface is internally contradictory and security-relevant. Such contradictions can cause policy bypass in orchestration layers, where a skill categorized as read-only is actually used for write actions like messaging.
The trigger language is broad enough to match many general logistics-related conversations, increasing the chance that the skill is invoked when the user did not intend to use this specific external service. Overbroad invocation raises privacy and autonomy concerns because user queries may be sent to third-party APIs without sufficiently precise intent matching.
The skill is presented as a public logistics-search capability, but it also instructs the agent to pivot into authenticated private messaging using returned userSlug values. That expands the operational scope from passive search into active outbound contact, which can surprise users, bypass expected consent boundaries, and enable unintended transmission of user content to third parties.
The documentation describes sending authenticated private messages to providers using a returned identifier, but it does not require explicit user warning or consent before transmitting message content. This can lead to unintended contact, disclosure of sensitive business details, or abuse of stored credentials for outbound communication.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/spQuery/getLogisticsLabels" \
-H "Content-Type: application/json"
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
curl -X GET "https://data.mjzj.com/api/spQuery/getLogisticsLabels" \
-H "Content-Type: application/json"
The reusable prompt repeats broad activation guidance without boundaries, reinforcing a pattern of aggressive skill invocation. In an agent setting, repeated broad prompts can bias tool selection toward external API calls even when a local answer or clarification would be safer.
No suspicious patterns detected.