Security audit

kuaidihelp-skill

Security checks for vulnerabilities and agentic risk

Overview

This shipping helper matches its stated purpose, but it handles real personal shipment data and order changes with under-disclosed unsafe execution, logging, and bundled credential risks.

Review carefully before installing. Use only with non-sensitive test data unless the logging and command-line handling are fixed, remove or rotate the bundled API key, avoid unsafe execution overrides, and require explicit confirmation before any order cancellation.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/config.json:2
Finding: Hard-Coded Kuaidihelp API Credentials
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/kuaidihelp.py:31
Finding: Sensitive Shipment Data Exposed Through Process Arguments and Debug Output
Content: View full analysis
","shipper_city":"","shipper_district":"","shipper_address":"","shipper_name":"","shipper_mobile":""},"recipient":{"shipping_province":"","shipping_city":"","shipping_district":"","shipping_address":"","shipping_name":"","shipping_mobile":""},"package_info":"","package_weight":"","package_note":"","package_pics":"","brand":"","place_volume":"","reserve_start_time":"","reserve_end_time":"","arrivePay":"1"}' ``` ### Technical Analysis Command-line arguments are not an appropriate transport for secrets or personal information. Depending on the operating system and execution environment, process arguments can be captured by: - Process inspection utilities. - ...[truncated 2015 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:43
Finding: Unnecessary Unsafe-Execution Override in Documented Workflows
Content: View full analysis
","city":"","district":"","address":""},"recipient":{"province":"","city":"","district":"","address":""},"pay_type":"2","volume":"","weight":""}' ``` The same override is used for logistics, order creation, and cancellation: ```bash OPENCLAW_ALLOW_UNSAFE_EXEC=1 python scripts/kuaidihelp.py logistics '{"waybill_codes":"","phone":"","result_sort":"0"}' ``` ```bash OPENCLAW_ALLOW_UNSAFE_EXEC=1 python scripts/kuaidihelp.py cancel '{"shipper_type": "", "order_id": "", "third_order_id":"", "reason":""}' ``` ### Technical Analysis The documented commands explicitly set `OPENCLAW_ALLOW_UNSAFE_EXEC=1`, even though the reviewed script only requires normal Python execution, local configuration access, and outbound HTTPS access to the service provider. An unsafe-execution override is broader than the legitimate functional requirement and conflicts with least-privilege design. It can reduce the effectiveness of platform safeguards around command execution. The direct consequences depend on how the hosting OpenClaw environment interprets this variable, but the skill provides no justification for enabling it and does so for every operation. This issue is amplified by constructing shell commands containing user-supplied shipment values. Although the shown quoting pattern does not by itself establish a confirmed comman ...[truncated 1585 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill instructs collection and transmission of highly sensitive personal data for shipment creation and logistics lookup, including names, full addresses, phone numbers, and potentially package photos, but provides no privacy notice, consent guidance, minimization advice, or warning about sending this data to a third-party service. In an agent setting, this increases the risk of over-collection, accidental disclosure, and unauthorized transmission of PII without the user understanding the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill exposes an order-cancellation action that can change real-world shipment state, but it does not warn that cancellation is irreversible or require an explicit confirmation step before execution. In practice, an agent could cancel a valid shipment based on ambiguous, mistaken, or maliciously induced input, causing operational disruption and potential financial or customer-service impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The code prints the full payload_list before sending it, which includes shipment/order details in data and authentication fields such as app_id and sign. Shipping addresses, names, phone numbers, and order metadata may end up in logs, terminals, or monitoring systems where they can be accessed by unintended parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script sends order, logistics, and quotation data to a remote HTTPS API, and the sample inputs show this may include addresses, names, phone numbers, and order details. There is no docstring, comment, or explicit user-facing warning explaining that this personal data will be transmitted to an external service.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: With no manifest available, there is no declared scope justifying access to ambient secrets. The code conditionally pulls KUAIDIHELP_API_KEY and KUAIDIHELP_API_ID from the process environment and uses them to authenticate remote requests, which is a privileged capability beyond simple argument processing.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.