Carrier Relationship Management

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:04 AM UTC
• Version: 1.0.0

Overview

This skill provides disclosed freight carrier-management guidance and templates, with no hidden execution, persistence, or unrelated data access found.

Install is reasonable for advisory carrier-management support, but keep a human transportation/procurement owner approving carrier awards, suspensions, exits, rate commitments, and external messages. If running the eval script, provide secrets through environment-based handling instead of command-line --api-key arguments.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: evals/run_evals.py:6

Finding

API Key Exposure Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: evals/run_evals.py, lines 6–8
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

python run_evals.py --api-key $ANTHROPIC_API_KEY
python run_evals.py --scenario CRM-001 --api-key $ANTHROPIC_API_KEY
python run_evals.py --verbose --api-key $ANTHROPIC_API_KEY

Technical Analysis

The usage documentation recommends supplying the Anthropic API key through the --api-key command-line option. Before starting Python, the shell expands $ANTHROPIC_API_KEY into its plaintext value. The resulting credential is placed in the new process's argument vector.

Depending on the operating-system configuration, process arguments may be visible to other local users or captured by process-monitoring agents, diagnostic systems, audit logs, job schedulers, or shell-history tooling. Although the key is not hardcoded in the repository, the documented invocation creates an insecure credential-handling pattern.

Attack Path

1. A user follows one of the documented commands.
2. The shell expands $ANTHROPIC_API_KEY to the plaintext credential.
3. The expanded key is included in the Python process's command-line arguments.
4. A local user, monitoring service, process collector, or logging integration reads or records those arguments.
5. The observer extracts the API key.
6. The exposed key is reused to issue unauthorized API requests within the permissions and limits associated with that credential.

This path requires local process visibility or access to a system that records command-line arguments.

Impact Assessment

An attacker who obtains the key may:

• Make unauthorized Anthropic API requests.
• Consume the account's API quota or incur charges.
• Access API resources permitted to the compromised key.
• Disrupt evaluation activity by exhausting rate or spending limits.

This issue does not directly grant operating-system privileges. Its ...[truncated 66 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove examples that pass secrets through --api-key.
2. Read ANTHROPIC_API_KEY directly from the environment inside the evaluation framework without copying it into sys.argv.
3. If interactive credential entry is necessary, use protected standard input through Python's getpass.getpass().
4. Ensure logs and exception messages never print the credential or a complete invocation containing it.
5. Redact sensitive command-line parameters in process-monitoring and CI/CD systems where command-line support must be retained for compatibility.
6. Update the usage documentation to recommend a safer invocation:

bash

export ANTHROPIC_API_KEY='...'
python run_evals.py

7. Rotate any API key that may already have been exposed through process listings, logs, shell history, or monitoring systems.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description says this skill provides domain functionality for carrier relationship management and freight strategy. The actual code chunk does not implement any of those business behaviors. Instead, it is infrastructure for running evals against the capability. That is a materially different primary purpose from the declared skill behavior. There are no suspicious extra permissions or external resource accesses shown, but the code’s purpose is clearly testing/orchestration rather than carrier portfolio management, rate negotiation, performance scorecarding, or compliance vetting.

Content

No source excerpt is available for this finding.

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · references/edge-cases.md (reported line 192)May include surrounding context.

md

**Why It's Tricky:**
Carrier financial distress is a slow-motion crisis. The carrier doesn't fail overnight — they degrade over weeks or months. During that degradation, their service deteriorates, their drivers leave, their insurance coverage becomes unreliable, and your freight is increasingly at risk. But cutting them immediately creates a capacity gap on 8 lanes, and if you're wrong about the distress, you've damaged a 3-year relationship based on speculation.

The other complexity: if TransWay is in distress and you're 6% of their revenue, your sudden exit could accelerate their failure — creating the exact outcome you're trying to avoid. Other shippers on TransWay's network would also be affected, and word travels fast in the carrier community that you pulled volume from a struggling carrier without warning.

**Common Mistake:**
Ignoring the warning signs because "their OTD is still above 90%." Financial distress takes 3-6 months to manifest in service metrics. By the time OTD drops below 85%, the carrier is in crisis and your options are worse. The other mistake: immediately pulling all volume, which creates an acute capacity gap and — if TransWay finds out why — damages your reputation as a shipper who panics.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description is broadly scoped ('use when managing carriers, negotiating rates, evaluating carrier performance, or building freight strategies') without clear boundaries, which can cause over-invocation in adjacent logistics or procurement contexts. Over-broad activation increases the chance the agent will apply this skill in situations requiring legal, compliance, or operational judgment beyond the skill's intended limits, potentially leading to unsafe or unauthorized recommendations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This JSON file contains agent outputs and evaluation content that prescribe exact English-language communications, subjects, scripts, and customer/carrier messaging throughout the dataset. Because the file provides only English communication templates and no user opt-in or locale choice, it can violate a language/locale policy requiring user choice rather than forcing a specific language.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 326)May include surrounding context.

json

"weight": 0.50,
          "rubric": {
            "pass": "Calculates total cost per load (linehaul + FSC + expected detention) for both carriers at all three diesel prices. Shows that Gulf Coast's lower linehaul is offset by their aggressive FSC schedule and higher detention cost. At current diesel ($3.92), Southern Express total cost should be approximately $1,660-$1,700 per load while Gulf Coast is approximately $1,680-$1,720. At $4.50 diesel, the gap widens significantly in Southern Express's favor.",
            "fail": "Compares only linehaul rates without modeling FSC. Does not calculate at multiple diesel scenarios. Awards based on the $0.14/mile linehaul difference without checking total cost."
          }
        },
        {

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Lines L008-L010 state that all thresholds, rate assumptions, and benchmarks reflect US domestic freight operations. This is a locale-specific constraint presented as a default requirement rather than an explicit user choice, which matches the policy category for locale constraints lacking opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.