ClawHub
Back to skill

Security audit

Correios Rastreio

Security checks for vulnerabilities and agentic risk

Overview

This is a straightforward Correios package-tracking skill, with some dependency and local-history caveats but no hidden or malicious behavior found.

Use this only if you want a Portuguese/Brazil-focused Correios tracker and are comfortable providing a Correios API key through CORREIOS_API_KEY. Before installing, update or audit the npm dependencies, and remember that tracking codes and favorites are saved locally in the skill directory.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (14)

Ae1

High
Category
analysis-evasion
Content
node src/index.js track PW123456789BR
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node src/index.js track PW123456789BR
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node src/index.js track PW123456789BR
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node src/index.js track PW123456789BR
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Ae1

High
Category
analysis-evasion
Content
node src/index.js track PW123456789BR
Confidence
100% confidence
Finding
Referenced artifact was not completely inspected

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The lockfile pins axios to 1.13.6, and the provided analysis reports multiple known advisories affecting that version, including SSRF-related NO_PROXY bypass and prototype-pollution-related request/response manipulation risks. In a skill that performs HTTP requests, a vulnerable HTTP client is directly security-relevant because it can affect outbound request routing, credential handling, and trust boundaries.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High
Category
Supply Chain
Confidence
90% confidence
Finding
form-data 4.0.5 is reported as vulnerable to CRLF injection through unescaped multipart field names and filenames. If any part of multipart form construction uses untrusted input, an attacker may be able to inject crafted headers or alter request structure, potentially leading to request smuggling-like effects or downstream parser abuse.

Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High
Category
Supply Chain
Confidence
96% confidence
Finding
The project depends on axios through a version range that can resolve to affected releases, and the static finding indicates a known vulnerable installed/resolved version. In a package-tracking skill that makes outbound HTTP requests, axios flaws related to SSRF, proxy bypass, credential leakage, or response manipulation can directly affect requests to external services and expose tokens, internal network access, or integrity of tracking data.

Credential Access

High
Category
Privilege Escalation
Content
const BASE_URL = 'https://api.correios.com.br';
const DATA_FILE = path.join(__dirname, 'data.json');

// Get API key from environment
function getApiKey() {
  return process.env.CORREIOS_API_KEY;
}
Confidence
70% confidence
Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Vague Triggers

Medium
Confidence
95% confidence
Finding
The trigger phrases include very generic terms like "pedido" and "encomenda" that commonly appear in ordinary user conversations unrelated to this specific skill. Broad activation increases the chance of unintended invocation, which can cause context hijacking, user confusion, and accidental exposure of package-related queries or history actions in situations where the user did not intend to use this skill.

Natural-Language Policy Violations

Medium
Confidence
96% confidence
Finding
The skill description and all user-facing strings are written in Portuguese, and date formatting is forced to 'pt-BR'. This imposes a specific language/locale on users without offering a choice or clearly documenting that the skill is intentionally limited to a Portuguese-speaking or Brazil-specific audience.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low
Category
Supply Chain
Confidence
90% confidence
Finding
follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Because axios depends on this library for redirect behavior, the issue can expose secrets such as bearer tokens or API keys when the application follows attacker-controlled or unexpected redirects.

Unpinned Dependencies

Low
Category
Supply Chain
Content
"start": "node src/index.js"
  },
  "dependencies": {
    "axios": "^1.6.0"
  }
}
Confidence
91% confidence
Finding
The dependency is specified with a caret range (^1.6.0), which allows automatic installation of newer 1.x releases rather than a fully fixed version. This weakens supply-chain control and can unexpectedly pull in vulnerable or breaking releases, which is especially relevant here because the same package is also flagged with known security advisories.

Description-Behavior Mismatch

Low
Confidence
95% confidence
Finding
The module header at L004-L006 describes a package-tracking skill, which implies querying shipment status. In addition to that core behavior, the code loads and writes local state in data.json for history and favorites, introducing persistent storage behavior not reflected in the stated description.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical
Code
suspicious.env_credential_access
Location
src/index.js:17

File appears to expose a hardcoded API secret or token.

Critical
Code
suspicious.exposed_secret_literal
Location
SKILL.md:45