kuaidi100-logistics

• Analyzed: May 11, 2026, 6:14 AM
• Findings: 1
• Version: 1.0.5
• Hash: bfdcd8906f233b6b74329c77e234706aed27848ca6a82478e0e0e2e55df83c3d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill provides logistics tracking via the Kuaidi100 API (api.kuaidi100.com) but contains shell injection vulnerabilities. In SKILL.md, the instructions for tools like 'query_trace' and 'auto_number' direct the agent to execute curl commands where user-provided variables (e.g., kuaidiNum) are interpolated directly into a bash string, which could lead to arbitrary command execution if the input is not properly sanitized.