Security audit

kuaidi-query

Security checks for vulnerabilities and agentic risk

Overview

The skill largely matches its courier-tracking purpose, but its claimed privacy protections are not reliably enforced and subscription output can expose stored phone suffixes.

Review carefully before installing. Use this only if you are comfortable sharing tracking numbers and optional phone suffixes with KDNiao, and avoid forwarding JSON or full logistics output into group chats until the phone-suffix leak and privacy-redaction enforcement are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/subscribe_tracking.py:17
Finding: Subscription JSON output exposes stored phone verification suffixes
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/privacy_settings.py:25
Finding: Declared group privacy policy is not enforced by logistics output paths
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: 声明描述的是一个面向用户的快递物流查询与提醒技能，核心能力应围绕快递 API 调用和物流信息处理展开。但提供的代码片段只是一个废弃脚本包装器：导入 check_changes.main，提示改用另一个脚本，然后退出并传递命令行参数。该片段的主要目的与快递物流无关，也没有体现声明中的任何关键能力。因此描述与实际代码行为存在明显不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: 声明描述的是面向用户的快递查询与提醒技能，而实际代码仅是配套的初始化脚本。它的主要作用是读取命令行参数或环境变量/交互输入，创建或校验本地 JSON 配置文件，并返回初始化或状态结果。虽然其中涉及快递鸟 API 凭据、隐私模式和订阅文件，和声明场景存在一定关联，但该代码块本身没有调用快递鸟 API、没有查询物流轨迹、没有执行订阅通知、没有提取取件码，也没有识别快递公司。因此这段代码的实际主要行为与声明的主要功能不一致，应判定为描述与代码行为不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: 声明描述的是一个面向用户的完整快递物流查询/订阅技能；但给出的代码片段只负责“群聊隐私策略”配置管理，包括 show/set-mode/trust/untrust/resolve 等命令，读写本地配置文件并返回 full/redact 等策略。虽然这与声明中的“群聊隐私脱敏”子功能有关，但它只是配套配置工具，无法支撑所宣称的核心能力。代码没有网络请求、没有调用快递鸟 API、没有处理快递单号、没有任何订阅或提醒逻辑，因此代码实际行为与声明用途存在明显且重大的不匹配。
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: 代码主功能与声明中的“快递物流查询”部分一致，且确实包含有限的“快递公司识别”能力。但声明列出的多项关键能力在该代码中没有体现：没有任何订阅接口调用或持久化订阅管理；没有定时任务、轮询、调度或提醒发送机制；没有针对取件码的文本提取/解析；也没有群聊场景下的隐私脱敏处理。由于这些都是声明中明确列出的用户可用能力，而代码只覆盖查询与部分公司识别，因此描述高估了实际能力，构成描述与行为不一致。
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares shell, file, environment, and network-relevant behavior through its documented commands and environment variables, but does not explicitly constrain tool scope. That creates an avoidable over-privilege risk: an agent or runtime may grant broader capabilities than necessary, increasing the blast radius if the skill is misused or compromised.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The entire skill documentation is written only in Chinese and does not indicate that another language can be used or that the locale restriction is optional. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This Python file contains natural-language error messages and interactive prompts exclusively in Chinese, including the credential prompts and initialization errors. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains natural-language strings that force a specific language for errors and command descriptions. Under the stated policy, hard-coding a language without user opt-in or a documented region-specific justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The argparse description and success/status messages are presented only in Chinese, with no indication that users can choose another language. This creates the same language-policy issue across the main user interaction surface of the tool.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · scripts/query_tracking.py (reported line 19)May include surrounding context.
python
from kuaidi_common import latest_trace_of, sorted_traces, state_icon, state_text API_URL = "https://api.kdniao.com/api/dist" HOME_CONFIG = Path(os.path.expanduser(os.environ.get( "KUAIDI_CONFIG_FILE", "~/.openclaw/config/kuaidi-query.json" )))

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The script returns error messages, help descriptions, and status text in Chinese only, with no option for the user to select language or locale. This is a natural-language policy issue because the skill imposes a specific language rather than offering choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The README is written entirely in Chinese and the usage section instructs users to speak to the assistant using Chinese phrases, but it does not indicate that other languages are supported or that Chinese is an optional locale. This can be a natural-language policy issue when skills should not force a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file presents all user-facing guidance in Chinese and does not indicate that the skill is region-specific or that other language options are available. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown file is entirely presented in Chinese from the title onward, with no indication that users may choose another language or that the skill is intentionally restricted to a Chinese-only audience. Under the natural-language policy rule, forcing a specific language without opt-in can be a locale policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code emits a user-facing stderr message only in Chinese: "daily_check.py 已弃用，请改用 check_changes.py". The policy requires avoiding forced language or locale constraints unless the skill offers user choice or clearly documents a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The argparse description shown to users is only in Chinese, which imposes a single language on all users. The file does not indicate that the skill is intentionally limited to Chinese-speaking users or a China-specific deployment context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This code transmits the user's tracking number and, when provided, the recipient phone suffix to an external API via HTTP request. Although the module docstring says it queries tracking data, there is no explicit user-facing disclosure in the CLI help, output, or nearby comments that this information is sent to a third-party service.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The example values for all user-facing configuration fields are written only in Chinese, which constitutes a natural-language locale constraint in the file content. There is no indication that the skill is region-specific or that users may use another language, so this appears to enforce a specific language without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.