Logistics Exception Management

• Outcome: Review
• Latest audit: Sep 11, 2026 · 12:05 AM UTC
• Version: 1.0.0

Overview

The skill is coherent logistics guidance, but it includes an unsafe optional eval runner and business-impacting instructions that lack clear approval safeguards before sending messages or taking financial and operational actions.

Use this skill as advisory logistics support, not as authority to automatically email carriers or customers, file regulatory reports, approve settlements, hold payments, re-route freight, or remove carriers without human review. Verify recipients and minimize shipment, customer, cargo value, and claim details in external messages. Confirm the applicable jurisdiction before relying on US-specific legal guidance. Do not run the eval runner unless the external shared eval framework is trusted, and do not pass API keys on the command line.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Error

• Location: evals/run_evals.py:15

Finding

Execution of an Unverified External Evaluation Framework

Content

View full analysis

Vulnerability Details

File Location: evals/run_evals.py, lines 15–26
Vulnerability Type: Untrusted module search-path modification and external code execution
Risk Level: High

Vulnerable Code

python

REPO_ROOT = Path(__file__).resolve().parent.parent.parent.parent
sys.path.insert(0, str(REPO_ROOT / "shared"))

from eval_framework import main

if __name__ == "__main__":
    # Inject capability path if not provided
    if "--capability" not in sys.argv:
        capability_dir = Path(__file__).resolve().parent.parent
        sys.argv.extend(["--capability", str(capability_dir)])

    main()

Technical Analysis

The evaluator prepends a filesystem directory outside the audited project to sys.path and then imports eval_framework from that location. Given the supplied artifact path, traversing four parent directories from evals/run_evals.py resolves REPO_ROOT to the filesystem root, causing the runner to search /shared first.

The implementation of eval_framework is not included in the audited project. There is therefore no integrity guarantee, version pinning, or source verification for the code imported and executed by the runner. Python executes module-level code immediately during import, before main() is called.

This is an unsafe dependency boundary rather than confirmed malicious behavior in the supplied files. Exploitation requires an attacker to create or modify the resolved external module, such as /shared/eval_framework.py, or otherwise control the resolved dependency location.

Attack Path

1. An attacker obtains write access to /shared, or compromises the external shared framework installation.
2. The attacker creates or modifies /shared/eval_framework.py.
3. A user launches evals/run_evals.py.
4. The runner inserts /shared at the beginning of sys.path.
5. Python imports the attacker-controlled module and executes its module-level code.
6. Th ...[truncated 808 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove runtime sys.path modification and import the framework as a normal, packaged dependency.
2. Pin the dependency to an exact version and verify it with a lockfile and cryptographic hashes.
3. If the framework must remain local, resolve it relative to a validated repository root and reject paths that escape that root.
4. Verify the resolved module path before import:
   • Require it to be inside an approved directory.
   • Reject symbolic-link escapes.
   • Enforce appropriate ownership and write permissions.
5. Run evaluation code in a restricted environment with minimal filesystem, network, and secret access.
6. Add a startup check that reports the exact framework path and fails closed if the trusted framework is absent.
7. Do not pass secrets to the framework unless they are strictly required, and scope any API key to the minimum necessary permissions and budget.

T09 · Insecure Skill Coding Practices

Warning

• Location: evals/run_evals.py:6

Finding

Anthropic API Key Exposed Through Process Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: evals/run_evals.py, lines 6–8
Vulnerability Type: Plaintext secret exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

Usage:
    python run_evals.py --api-key $ANTHROPIC_API_KEY
    python run_evals.py --scenario LEM-001 --api-key $ANTHROPIC_API_KEY
    python run_evals.py --verbose --api-key $ANTHROPIC_API_KEY

Technical Analysis

The documented invocation expands ANTHROPIC_API_KEY into the command-line argument list. After shell expansion, the plaintext credential becomes part of the process command line.

Depending on the operating system and execution environment, command-line arguments can be exposed through process-inspection tools, /proc interfaces, CI/CD logs, debugging telemetry, audit systems, job metadata, or wrapper-script logging. They may also be retained in copied commands or diagnostic records.

Although the key is sourced from an environment variable rather than hardcoded in the repository, the recommended usage transfers it into a less protected channel.

Attack Path

1. A user follows one of the documented commands.
2. The shell expands $ANTHROPIC_API_KEY to the plaintext credential.
3. The expanded value is passed to Python as an --api-key argument.
4. A local user, monitoring agent, CI logger, or process-inspection mechanism records or reads the process command line.
5. The exposed key is reused to make unauthorized Anthropic API requests.

Impact Assessment

Exposure may allow unauthorized use of the affected Anthropic account within the key's assigned permissions and limits. Potential consequences include:

• Unauthorized API consumption and financial charges.
• Exhaustion of rate limits or account quotas.
• Access to capabilities available to the compromised key.
• Service disruption caused by key revocation and emergency rotation.

This issue does not directly grant host pr ...[truncated 105 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove --api-key from the documented command examples.
2. Have the evaluation framework read ANTHROPIC_API_KEY directly from the environment without copying it into sys.argv.
3. For interactive execution, support secret input through getpass or standard input without terminal echo.
4. In automated environments, retrieve the key from a protected secret manager at runtime.
5. Ensure exceptions, verbose logs, and diagnostic output redact credentials.
6. Use a narrowly scoped evaluation key with spending limits and regular rotation.
7. Document immediate key revocation and rotation procedures for suspected exposure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents an operational skill for managing shipping exceptions and freight claims. However, the provided code does not implement any logistics workflows, claims procedures, escalation logic, or carrier dispute handling. Instead, it is a thin wrapper around an evaluation framework that prepares command-line arguments and launches tests for the capability. This is a materially different primary purpose from the declared functionality, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The invocation guidance says to use the skill when handling shipping exceptions, freight claims, delivery issues, or carrier disputes, but it does not define clearer boundaries or exclusions. Phrases like 'delivery issues' are broad and could overlap with many routine support conversations, increasing the chance of unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This JSON file contains embedded natural-language operational instructions, and the text at L0660 assumes a specific U.S. DEA regulatory framework as the required handling path. Because the file does not state that the scenario or skill is limited to U.S. controlled-substance workflows, this constitutes a locale/regulatory policy constraint expressed without documented justification in the file itself.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 353)May include surrounding context.

json

"weight": 0.25,
          "rubric": {
            "pass": "De-escalates the argument immediately — remove the dock supervisor from the confrontation if needed. The count is the count; arguments don't change pallet numbers. Suggests a joint recount with the driver present, checking all pallets on the trailer including freight for other consignees to verify no misrouted pallets.",
            "fail": "Ignores the interpersonal conflict. Takes the driver's word without verification. Escalates the argument further. Does not suggest a joint recount."
          }
        },
        {

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · evals/scenarios.json (reported line 1409)May include surrounding context.

json

"weight": 0.25,
          "rubric": {
            "pass": "De-escalates the argument immediately — remove the dock supervisor from the confrontation if needed. The count is the count; arguments don't change pallet numbers. Suggests a joint recount with the driver present, checking all pallets on the trailer including freight for other consignees to verify no misrouted pallets.",
            "fail": "Ignores the interpersonal conflict. Takes the driver's word without verification. Escalates the argument further. Does not suggest a joint recount."
          }
        },
        {

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The file instructs agents to directly substitute shipment, customer, and contact details into email templates and send them, but it does not require recipient verification, minimum-necessary disclosure, or redaction checks. In a logistics context, misaddressed or over-shared messages could expose tracking numbers, cargo values, customer identities, phone numbers, claim details, and legal correspondence to unintended parties, creating confidentiality, fraud, and social-engineering risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The document states that all thresholds, timelines, and cost assumptions reflect US domestic and international freight operations, which hard-codes a US locale/jurisdictional framing into the skill reference. Because this is a broadly framed reference file and does not explicitly present the US focus as an opt-in or constrained regional mode, it can conflict with language/locale policy expectations for user choice or documented scope.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 75% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · references/edge-cases.md (reported line 272)May include surrounding context.

md

- Delivery receipts signed by day laborers without SKU verification are essentially worthless for claims purposes — they prove delivery happened but not what was delivered
- A 1-for-1 swap (1 pallet short on SKU A, 1 pallet over on SKU B, total count correct) is almost always a terminal misload, not a transit loss
- Construction sites with multiple subcontractors and multiple material suppliers are high-risk for inventory confusion — materials from different vendors get commingled
- If the grout and tile pallets are similar in size and wrapped in similar shrink wrap, the terminal dock worker likely couldn't distinguish them without checking labels
- Check whether the pallets had color-coded labels or SKU stickers visible through the shrink wrap — if not, this is partly a packaging/labeling failure at origin

**Documentation Required:**