ClawHub
Back to skill

Security audit

17track package tracking

Security checks for vulnerabilities and agentic risk

Overview

This is a real 17TRACK parcel-tracking skill, but its optional webhook handling can accept forged updates and it may send local parcel labels to 17TRACK without making that clear.

Install only if you are comfortable giving the skill a 17TRACK API token, storing parcel data in a workspace-local SQLite database, and sending tracking numbers plus carrier parameters to 17TRACK. Avoid public webhook exposure unless the signature-enforcement bug is fixed; prefer polling. Do not put private details in labels unless you also explicitly set a non-sensitive --tag or the label-to-tag behavior is changed.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/track17.py:1234
Finding

Webhook signatures are detected but not enforced

Content
View full analysis
Remediation
View remediation

other

Warning
Location
scripts/track17.py:740
Finding

Local parcel labels are implicitly disclosed to 17TRACK

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding

The skill requires access to environment variables, local file read/write, and network operations, but those capabilities are not explicitly declared as permissions in the skill metadata. This creates a transparency and policy-enforcement gap: reviewers or runtime controls may underestimate what the skill can access, increasing the chance of over-privileged execution or unsafe deployment.

Content

No source excerpt is available for this finding.

Env Variable Harvesting

High
Category
Data Exfiltration
Confidence
89% confidence
Finding

The webhook processing path retrieves the shared secret but does not require a valid signature before ingesting and applying webhook data. If the inbox or HTTP listener is reachable by an attacker, forged payloads can create packages and overwrite tracking state, causing integrity issues and potentially misleading automation or users.

Content

Scanner excerpt · scripts/track17.py (reported line 1339)May include surrounding context.

python
conn = connect_db(p["db"])
    init_db(conn)

    secret = args.secret or os.environ.get("TRACK17_WEBHOOK_SECRET")

    inbox = p["inbox"]
    files = sorted([f for f in inbox.glob("*.json") if f.is_file()])