T08 · Insecure Dependencies
Error
- Location
scripts/track_express.py:15- Finding
External Import Path Allows Hijacking of express_codes Module
- Content
View full analysis
- Remediation
View remediation
Security audit
Express Tracker
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent courier-link generator, but its scripts can import executable code from an unreviewed developer-specific path before using the bundled files.
Review this skill before installing. Its normal function is low-impact link generation, but the publisher should remove the hardcoded external Python import path before users run it. Only open generated Kuaidi100 links when you are comfortable sharing the tracking number with that site, and keep input/output paths limited to files you intentionally choose.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
scripts/batch_track.py:13- Finding
External Import Path Allows Hijacking of track_express Module
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
The documented behavior materially overstates what the skill appears to implement, claiming logistics querying, query-link generation, and batch tracking that static analysis says are not actually present. Security-wise, description/behavior mismatches undermine informed consent and review, making it easier to hide missing features today or slip in unrelated functionality later under a trusted label.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 84% confidence
- Finding
The skill documents scripts that read input files and write output files, but it does not declare any tool scope or permissions boundary. This creates an integrity and transparency problem: a host agent or reviewer cannot easily constrain file access, and users are not clearly informed that local file I/O is part of the skill's behavior.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example trigger "我的快递到哪了" is a natural conversational phrase rather than a narrowly scoped invocation, which can increase the chance of unintended activation in ordinary chat. The description also presents usage scenarios as broad examples without clarifying activation boundaries or exclusions.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill sends or encourages sending tracking numbers to an external courier-tracking website without an explicit warning. Tracking numbers can be sensitive personal or business data because they may reveal purchase activity, addresses, senders, timing, or customer relationships when submitted to a third-party service.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script prepends a developer-specific absolute path to sys.path and imports code from there, which breaks package isolation and can cause the skill to load unintended local code if that path exists on the host. In environments where an attacker can place or influence files at that location, this becomes a code-loading risk; even without an attacker, it is unsafe and unreliable because behavior depends on a private filesystem layout.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code iterates over user-supplied tracking numbers and calls
get_query_info, which by the script's purpose and output links is an external express-query operation. While the module docstring says it performs batch tracking queries, there is no visible warning in this file that tracking numbers will be sent to an external service, which is a privacy-relevant network action.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This code file contains natural-language strings that present the tool exclusively in Chinese, including the module docstring and argument/help text. Under the policy, forcing a specific language without user opt-in or a documented regional justification is a natural-language policy violation.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest and module docstring describe this as a 快递物流查询/快递查询 skill, which implies retrieving shipment status information. However, get_query_info only packages the tracking number, optionally infers a carrier, and constructs a kuaidi100 URL; no network request or logistics data retrieval occurs anywhere in the file.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
Argument descriptions, prompts, and status messages are all hardcoded in Chinese and there is no mechanism for selecting another language. This creates a locale/language restriction without explicit opt-in, which matches the policy-violation category.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instructional comments in this example file are written entirely in Chinese, which can impose a language requirement on users without offering any alternative or opt-in. The policy explicitly calls for flagging language or locale constraints when they are forced rather than optional or justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code file contains natural-language content that assumes a Chinese-speaking user, including the module description and later printed test output. The policy requires avoiding forced language/locale behavior unless the skill offers user choice or clearly documents that it is intentionally region-specific.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 79% confidence
- Finding
The script can launch a local browser via the --open flag, which causes a side effect beyond simple data formatting and link generation. While the URL is constrained to an HTTPS kuaidi100 link template, opening applications automatically can be risky in agent contexts because it may trigger unintended user-environment actions or leak tracking numbers into browser history/session state.
- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest says the skill supports '批量查询几个快递单号', but the CLI accepts only a single required --nu value and processes one tracking number per invocation. There is no loop, list input, or bulk-processing interface in the implementation.
- Content
Static analysis
No suspicious patterns detected.