T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:49- Finding
Sensitive Credentials and Personal Shipment Data Exposed in GET Request URLs
- Content
View full analysis
- Remediation
View remediation
Security audit
kuaidi100-logistics
Security checks for vulnerabilities and agentic risk
Overview
This logistics skill does what it claims, but it can proactively send sensitive shipment details to a third-party API with limited user-facing control or warning.
Review before installing. Use this only when you are comfortable sharing tracking numbers, phone numbers, addresses, routes, timestamps, and logistics history with Kuaidi100. Prefer explicit invocation, avoid casual auto-triggering, and do not use it with sensitive business or personal shipments unless the API key and request logging risks are acceptable.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:167- Finding
Untrusted Remote Markdown Returned Without Validation or Sanitization
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (10)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger language says the skill must be used whenever the user even casually mentions package tracking, which is overly broad and can cause unintended activation. In practice this can send tracking numbers, phone numbers, and addresses to an external API without sufficiently clear user intent or contextual confirmation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill does not warn users that tracking numbers, phone numbers, shipment addresses, and logistics history may be transmitted to a third-party API. Because the skill is designed to trigger proactively, the lack of notice increases the risk of silent disclosure of personal or commercially sensitive shipping data.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
This skill is explicitly built around transmitting user-supplied logistics data to an external API endpoint. External transmission is expected for the feature, but it is still a real security/privacy concern because the data can include tracking numbers, phone numbers, addresses, and shipment history.
- Content
API 基础地址
text https://api.kuaidi100.com/stdioKey 处理规则
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 98% confidence
- Finding
The query_trace call sends tracking numbers and potentially phone numbers to the third-party API via URL query parameters. This is sensitive because such data may be logged by intermediaries, shell history, monitoring systems, or the remote service, and the skill's broad activation language increases the chance of unintended disclosure.
- Content
curl 调用：
bash KEY="${KUAIDI100_API_KEY:-null}" RESULT=$(curl -s "https://api.kuaidi100.com/stdio/queryTrace?key=${KEY}&kuaidiNum=${快递单号}&phone=${手机号}") echo "$RESULT"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 95% confidence
- Finding
Even without a phone number, the queryTrace example still sends the user's tracking number to an external service. Tracking numbers can be sensitive identifiers linked to personal purchases or business shipments, so silent or automatic transmission creates a meaningful privacy risk.
- Content
md > 若手机号为空则省略 `phone` 参数： > ```bash > RESULT=$(curl -s "https://api.kuaidi100.com/stdio/queryTrace?key=${KEY}&kuaidiNum=${快递单号}") > ``` ---
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 94% confidence
- Finding
The autoNumber call transmits a tracking number to an external provider to infer the carrier. While functionally necessary, this still leaks shipment identifiers to a third party and may occur in cases where the user did not realize such transmission would happen.
- Content
curl 调用：
bash KEY="${KUAIDI100_API_KEY:-null}" RESULT=$(curl -s "https://api.kuaidi100.com/stdio/autoNumber?key=${KEY}&kuaidiNum=${快递单号}") echo "$RESULT"
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The estimatePrice request sends sender and recipient addresses plus carrier and weight data to the external API. Address data is highly sensitive personal information, and this skill provides no built-in consent or minimization controls before transmission.
- Content
curl 调用：
bash KEY="${KUAIDI100_API_KEY:-null}" RESULT=$(curl -s --get "https://api.kuaidi100.com/stdio/estimatePrice" \ --data-urlencode "key=${KEY}" \ --data-urlencode "kuaidicom=${快递公司编码}" \ --data-urlencode "recAddr=${收件地址}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 97% confidence
- Finding
The estimateTime endpoint sends route information, and optionally order time and product type, to a third-party service. Combined origin/destination and timing information can reveal user movement, business operations, or purchasing patterns, making this a substantive privacy issue despite being core to the skill's purpose.
- Content
curl 调用：
bash KEY="${KUAIDI100_API_KEY:-null}" RESULT=$(curl -s --get "https://api.kuaidi100.com/stdio/estimateTime" \ --data-urlencode "key=${KEY}" \ --data-urlencode "kuaidicom=${快递公司编码}" \ --data-urlencode "from=${出发地}" \
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 99% confidence
- Finding
This call transmits detailed logistics history JSON along with route and order-time information to the external API. Historical tracking events can expose location timelines, delivery status, and potentially personal or business activity patterns, making this the most privacy-sensitive transmission in the skill.
- Content
curl 调用：
bash KEY="${KUAIDI100_API_KEY:-null}" RESULT=$(curl -s --get "https://api.kuaidi100.com/stdio/estimateTime" \ --data-urlencode "key=${KEY}" \ --data-urlencode "kuaidicom=${快递公司编码}" \ --data-urlencode "from=${出发地}" \
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The skill claims all API responses are already safe Markdown and should be returned directly, but the examples simply echo raw remote API output. Returning unvalidated third-party content can expose users to misleading formatting, prompt-injection-like instructions, or unsafe links/content emitted by the external service.
- Content
Static analysis
No suspicious patterns detected.