Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js track PW123456789BR
Security audit
Correios Rastreio
Security checks for vulnerabilities and agentic risk
Overview
This is a straightforward Correios package-tracking skill, with some dependency and local-history caveats but no hidden or malicious behavior found.
Use this only if you want a Portuguese/Brazil-focused Correios tracker and are comfortable providing a Correios API key through CORREIOS_API_KEY. Before installing, update or audit the npm dependencies, and remember that tracking codes and favorites are saved locally in the skill directory.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js track PW123456789BR
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js track PW123456789BR
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js track PW123456789BR
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node src/index.js track PW123456789BR
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The lockfile pins axios to 1.13.6, and the provided analysis reports multiple known advisories affecting that version, including SSRF-related NO_PROXY bypass and prototype-pollution-related request/response manipulation risks. In a skill that performs HTTP requests, a vulnerable HTTP client is directly security-relevant because it can affect outbound request routing, credential handling, and trust boundaries.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names and filenames. If any part of multipart form construction uses untrusted input, an attacker may be able to inject crafted headers or alter request structure, potentially leading to request smuggling-like effects or downstream parser abuse.
- Content
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 96% confidence
- Finding
The project depends on axios through a version range that can resolve to affected releases, and the static finding indicates a known vulnerable installed/resolved version. In a package-tracking skill that makes outbound HTTP requests, axios flaws related to SSRF, proxy bypass, credential leakage, or response manipulation can directly affect requests to external services and expose tokens, internal network access, or integrity of tracking data.
- Content
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
js const BASE_URL = 'https://api.correios.com.br'; const DATA_FILE = path.join(__dirname, 'data.json'); // Get API key from environment function getApiKey() { return process.env.CORREIOS_API_KEY; }
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases include very generic terms like "pedido" and "encomenda" that commonly appear in ordinary user conversations unrelated to this specific skill. Broad activation increases the chance of unintended invocation, which can cause context hijacking, user confusion, and accidental exposure of package-related queries or history actions in situations where the user did not intend to use this skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill description and all user-facing strings are written in Portuguese, and date formatting is forced to 'pt-BR'. This imposes a specific language/locale on users without offering a choice or clearly documenting that the skill is intentionally limited to a Portuguese-speaking or Brazil-specific audience.
- Content
Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)
Low
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this library for redirect behavior, the issue can expose secrets such as bearer tokens or API keys when the application follows attacker-controlled or unexpected redirects.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 91% confidence
- Finding
The dependency is specified with a caret range (^1.6.0), which allows automatic installation of newer 1.x releases rather than a fully fixed version. This weakens supply-chain control and can unexpectedly pull in vulnerable or breaking releases, which is especially relevant here because the same package is also flagged with known security advisories.
- Content
json "start": "node src/index.js" }, "dependencies": { "axios": "^1.6.0" } }
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The module header at L004-L006 describes a package-tracking skill, which implies querying shipment status. In addition to that core behavior, the code loads and writes local state in data.json for history and favorites, introducing persistent storage behavior not reflected in the stated description.
- Content