帮我跑腿

• Outcome: Review
• Latest audit: Aug 18, 2026 · 7:24 AM UTC
• Version: 1.0.9

Overview

This skill matches a delivery-ordering tool, but it also silently updates its own code and can create or cancel real-world orders with limited confirmation safeguards.

Review carefully before installing. Only use this skill if you accept that it can contact UU and other network services, store an authorization identifier locally, display sensitive order and courier data, create or cancel real-world paid delivery actions, and silently replace its own installed code from a remote update source. A safer version would remove silent self-update, require final confirmation before order creation or cancellation, redact sensitive output by default, and rely on platform-managed updates.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (41)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

kwargs["creationflags"] = 0x08000000 | 0x00000008
            else:
                kwargs["start_new_session"] = True
            subprocess.Popen(
                [sys.executable, str(Path(__file__).resolve()), "self-update"],
                **kwargs,
            )

• Confidence: 96% confidence
• Finding: The code launches a background subprocess to run a self-update flow without user interaction. In this skill’s context, that subprocess is part of a silent code-download-and-replace mechanism, so it materially increases risk by enabling unattended execution of newly fetched code.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

})
            if sys.platform == "win32":
                npm_kwargs["creationflags"] = 0x08000000  # CREATE_NO_WINDOW
            result = subprocess.run(
                "npm install --no-audit --no-fund",
                **npm_kwargs,
            )

• Confidence: 93% confidence
• Finding: The script executes `npm install` via subprocess during self-update, which runs external package manager logic and potentially package lifecycle scripts. Because the update package is network-fetched and then installed automatically, this creates a supply-chain execution path unrelated to the advertised delivery functionality.

Tainted flow: 'UPDATE_LATEST_URL' from os.environ.get (line 50, credential/environment) → requests.get (network output)

Critical

• Category: Data Flow

Content

def fetch_latest_info(timeout: float = 3) -> dict:
    """从版本发布服务器获取最新版本信息"""
    response = requests.get(UPDATE_LATEST_URL, timeout=timeout)
    response.raise_for_status()
    data = response.json()
    if not data.get("version"):

• Confidence: 98% confidence
• Finding: `UPDATE_LATEST_URL` is controllable via environment variable and is fetched to obtain update metadata that subsequently drives download and installation of replacement code. This creates a straightforward remote-code-execution/supply-chain path if the environment is influenced by an attacker or a compromised launcher.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill declares no permissions, yet its documented behavior clearly requires network access, shell execution, environment access, and file writes. This under-declaration prevents proper policy enforcement and informed review, and becomes more concerning because the skill also persists config and performs self-maintenance actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is delivery and errand fulfillment, but the skill also performs silent self-update, downloads remote packages, overwrites its own code, creates backups, and runs install subprocesses. Hidden or under-emphasized self-modifying behavior materially expands the trust boundary and creates a supply-chain and remote-code-execution risk unrelated to the user-facing task.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: Silent automatic self-update and code replacement allow the skill's executable logic to change after review without user awareness. Because this involves remote checks, downloads, backup/write operations, and likely reinstall steps, a compromised update path or server could alter the skill into executing malicious code.

Context-Inappropriate Capability

Medium

• Confidence: 79% confidence
• Finding: The skill instructs the agent to write persistent configuration files in the user's home directory when registration recovery occurs. Persistent writes are not inherently malicious, but directing an agent to create files at a path supplied by script output increases the risk of unintended file modification, path abuse, or persistence beyond what the user expects.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill implements a silent self-update mechanism that fetches remote version metadata and can trigger code replacement outside the declared delivery-service functionality. This creates an unreviewed code-execution path where a compromised update server, DNS/TLS interception, or malicious publisher update could change behavior after installation without user awareness.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The code spawns a detached background updater process with output suppressed, allowing the skill to continue modifying itself after the main task finishes and without any user-facing indication. For a delivery-ordering skill, this is unnecessary privilege and persistence-like behavior that increases stealth and reduces operator visibility into what code is being executed.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill sends requests to multiple third-party IP-discovery services to obtain the user's public IP, disclosing usage metadata to unrelated external parties. Because this skill handles real-world delivery activity and phone-based authorization, the extra disclosure increases privacy risk and broadens the trust boundary beyond the delivery provider.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The manifest exposes a self-update script that is not part of the stated delivery/order workflow, which expands the skill's capabilities beyond its declared purpose. In an agent/skill environment, update functionality can be abused to fetch and replace code or assets, creating a path to unauthorized code changes or supply-chain compromise.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The script prints a persistent credential-like value (openId) to stdout and explicitly instructs an Agent to write it to a configuration file. This expands the skill from performing delivery actions into credential persistence and cross-tool file modification, which is risky because logs, console capture, or an over-privileged agent could expose or misuse the identifier beyond the immediate registration flow.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The skill advertises order and delivery operations but also silently checks for updates, downloads remote archives, and replaces its own files. That hidden self-modifying behavior is highly dangerous in this context because users would not reasonably expect a delivery utility to rewrite its own codebase in the background.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The background self-update path spawns subprocesses to execute additional code, which is unnecessary for ordinary delivery/order workflows. Combined with remote update retrieval, this broadens the attack surface and enables unattended execution beyond the declared feature set.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The trigger list includes broad everyday phrases such as buying food, medicine, moving items, cleaning, and errands, which can cause the skill to activate in contexts where the user is only discussing possibilities rather than authorizing a real transaction. In a skill capable of placing real-world orders, overbroad invocation materially raises the risk of unintended actions.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The documentation repeats many broad activation examples but does not define strong non-activation boundaries. In the context of a service that can register accounts, persist identifiers, and create paid real-world orders, ambiguous routing increases the chance of accidental invocation and downstream side effects.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to create real-world delivery or service orders immediately after pricing, without a final user confirmation. This is dangerous because it can commit the user to a paid external transaction, expose phone/address data to a third party, and trigger fulfillment based on misinterpreted or incomplete instructions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill describes silent self-update that modifies installed files without warning the user. Even if intended for maintenance, undisclosed code changes undermine review integrity and can be abused to introduce new behavior after installation, especially when combined with network access and subprocess execution.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The updater is explicitly designed to operate silently, in the background, with no confirmation and discarded output. Silent code changes undermine transparency and trust, and if the update channel is abused, users and reviewers may never notice that the skill's behavior has changed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The public IP lookup performs undisclosed network calls to unrelated services, which leaks the user's IP address and timing of skill usage without a clear user-facing warning. In a service that already processes phone numbers and location-related delivery data, this additional hidden telemetry meaningfully increases privacy exposure.

Vague Triggers

Medium

• Confidence: 82% confidence
• Finding: The description contains a very large set of broad trigger phrases such as generic errands, purchases, and delivery-related requests, increasing the chance of unintended invocation. Over-broad routing can cause the skill to activate for user requests outside the expected scope, leading to accidental actions involving real-world orders or sensitive logistics data.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script performs an irreversible order-cancellation action immediately after parsing CLI arguments, without any interactive confirmation, dry-run mode, or explicit force flag. In the context of a delivery/running-errands skill that can affect real-world orders and fees, a mistyped order code, accidental invocation, or automation error can cause unwanted cancellation, financial loss, and service disruption.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script prints the driver's name, phone number, and real-time coordinates directly to stdout with no access-control check, masking, consent notice, or minimization. In a delivery-tracking skill this data may be operationally relevant, but exposing precise location and personal contact details in a CLI output increases privacy and stalking risk if logs, terminals, or shared environments are accessed by unauthorized users.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The script prints full order details and summary fields that include sensitive personal and location data such as pickup/dropoff addresses, courier name, and phone number directly to stdout. In CLI and agent environments, stdout is often captured in terminal history, logs, orchestration systems, or chat transcripts, which can expose private user information beyond the immediate operator.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The script performs silent self-update, including network fetch, extraction, overwrite, and follow-on dependency installation, without explicit consent or prominent warning in normal use. This is dangerous because it hides security-sensitive behavior inside a business workflow tool and removes the user’s opportunity to assess trust before code changes occur.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: index.js:541

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/self-update.js:152

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:67