Logistics Tracking

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:11 PM UTC
• Version: 1.0.1

Overview

The skill's package-tracking purpose is coherent, but it asks users to run unpinned npm commands that can execute unreviewed code with local or server privileges.

Install only if you are comfortable trusting the external npm packages at install and runtime. Prefer pinned package versions, a controlled build or lockfile, least-privileged service accounts, and narrowly scoped exposure of `TRACK17_API_KEY`. No artifact-backed evidence of theft, destruction, or deception was found, but the current install instructions make the executed code mutable after review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:42

Finding

Unpinned Third-Party Packages Are Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 42-93
Vulnerability Type: Unpinned and automatically approved third-party dependency execution
Risk Level: High

Vulnerable Code

At line 42:

bash

npx -y @shopmeagent/logistics-tracking-mcp serve

At lines 70-71:

json

"command": "npx",
"args": ["-y", "@shopmeagent/logistics-tracking-mcp"]

At line 82:

json

"args": ["-y", "@shopmeagent/logistics-tracking-mcp"],

At line 93:

bash

npx skills add shopmeskills/mcp

Technical Analysis

The documented installation and execution procedures invoke third-party packages without specifying an exact version, integrity hash, lockfile, or other immutable artifact identifier. The -y option also suppresses interactive installation confirmation.

As a result, the package selected and executed at installation time can differ from the package that existed when this skill was audited. The effective behavior therefore depends on mutable external package-registry content that is not present in the reviewed project. Because the project contains only SKILL.md, the implementation downloaded by these commands cannot be verified from the audit artifact.

npm package lifecycle scripts and executable entry points can run code with the permissions of the invoking process. A malicious release, compromised publisher account, or compromised dependency could therefore execute attacker-controlled code during installation or startup.

Attack Path

1. An attacker compromises the publisher account, package release process, or dependency chain associated with @shopmeagent/logistics-tracking-mcp or the separately installed skill package.
2. The attacker publishes a malicious release under the package name resolved by the unpinned command.
3. A user follows the documented instructions and runs an npx command without an exact package version.
4. npm resolves and downloads the ...[truncated 1206 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin every downloaded package to an exact, reviewed version, for example:

   bash

   npx --yes @shopmeagent/logistics-tracking-mcp@1.0.1 serve
   

   The example version must be replaced with a version that has actually undergone security review.

2. Avoid using npx -y in security-sensitive deployment instructions. Require explicit operator confirmation or install dependencies during a controlled build stage.

3. Maintain a lockfile and use reproducible installation commands such as npm ci rather than resolving mutable dependency versions at runtime.

4. Verify package integrity using registry integrity metadata, signed provenance, checksums, or an internal artifact repository containing approved immutable packages.

5. Disable npm lifecycle scripts during installation where they are unnecessary, and separately review any scripts that must be enabled.

6. Include the implementation source in the audited project or provide a verifiable source repository and commit reference corresponding exactly to the published package.

7. Run the MCP server under a dedicated, least-privileged service account. Restrict filesystem access, outbound networking, and environment-variable exposure to the minimum required for package tracking.

8. Store TRACK17_API_KEY in a managed secret store and expose it only to the approved runtime process. Rotate the key immediately if an untrusted package version may have executed.

9. Pin the separately installed shopmeskills/mcp content to a reviewed immutable version or commit rather than relying on a mutable repository or package reference.

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The skill instructs users to execute an unpinned npm package via npx -y @shopmeagent/logistics-tracking-mcp, which fetches and runs whatever version is current at install time. If the package is compromised, a malicious version is published, or a dependency is hijacked, users may execute attacker-controlled code on their machine or server, including in the HTTP deployment flow where environment secrets such as TRACK17_API_KEY may be present.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 74% confidence

Finding

The documentation tells users to run npx skills add shopmeskills/mcp without a pinned version, which similarly executes the latest published code from npm at invocation time. While this is a more generic bootstrap command than the MCP server package itself, it still exposes users to supply-chain risk if the skills package or its dependencies are maliciously updated or compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.