小递查查-快递批量查询API技能

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:52 AM UTC
• Version: 1.0.0

Overview

This parcel-tracking skill appears purpose-aligned, but it needs review because it handles shipment data and API credentials in ways that can expose sensitive information.

Install only if you are comfortable sending tracking numbers and any required phone suffixes to the xdccy service. Avoid putting real API keys directly in commands; prefer a protected environment variable or secret manager, and be careful where exported result files are saved because they may contain detailed logistics and contact information.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/express_query.py:433

Finding

API Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Vulnerability Details

File Location: scripts/express_query.py:433-436
Related Documentation: SKILL.md:38-49
Vulnerability Type: Sensitive credential exposure through process arguments
Risk Level: Medium

Vulnerable Code

python

parser.add_argument("--numbers", required=True, help="快递单号列表，逗号分隔（格式：单号:手机尾号，如 SF123456:6553）")
parser.add_argument("--platform-id", required=True, help="平台ID (PlatformID)")
parser.add_argument("--member-id", required=True, help="会员ID (MemberID)")
parser.add_argument("--api-key", required=True, help="API密钥 (APIKey)")

The documented invocation also directs users to place these credentials directly in the command:

bash

python scripts/express_query.py --numbers 123456,789012 --platform-id xxx --member-id xxx --api-key xxx

Technical Analysis

The script requires the platform ID, member ID, and API key to be supplied as command-line arguments. Command-line arguments are not an appropriate secret-delivery mechanism because they may be exposed through:

• Shell history files.
• Process inspection utilities and operating-system process metadata.
• Agent execution transcripts, command logging, telemetry, or audit logs.
• Debug output from orchestration systems.
• CI/CD job definitions and retained build logs.

Although the script does not print the API key directly, the secret is exposed before the process begins because it forms part of the invocation. The API key is subsequently used to generate the request signature. The network request does not directly transmit the raw API key, but that does not mitigate local command-line disclosure.

Attack Path

1. A user or agent follows the instructions in SKILL.md and invokes the script with a real API key using --api-key.
2. The full invocation is retained in shell history, agent logs, process metadata, telemetry, or an automation record.
3. An attacker with access to one of those local rec ...[truncated 1135 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the --api-key command-line option as the primary secret-delivery mechanism.

2. Read the API key from a protected environment variable or a dedicated secret manager. For example:

   python

   import os
   
   api_key = os.environ.get("XDCCY_API_KEY")
   if not api_key:
       parser.error("XDCCY_API_KEY must be configured securely")
   

3. For interactive use, support hidden input through getpass.getpass() so the key is not echoed or stored in shell history.

4. If a configuration file is supported, require restrictive file permissions and ensure the file is excluded from source control.

5. Update SKILL.md examples so that no credential is placed directly in a command. Document secure environment-variable or secret-manager setup instead.

6. Redact all credentials from agent transcripts, telemetry, exception reports, and debug logs.

7. Prefer passing only the less-sensitive platform and member identifiers as arguments; keep the API key exclusively in protected secret storage.

8. Rotate credentials that may previously have appeared in command history or retained execution logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill instructs the agent to perform external network queries to a third-party logistics service and to write results to local files, but it declares no explicit tool scope or permission boundaries. This can cause the agent to invoke network and file-write capabilities without transparent user consent or platform-level restriction, increasing the chance of unintended data disclosure of tracking numbers, phone suffixes, or exported logistics data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The trigger conditions are broad enough that the skill may activate for general requests about shipment status or package tracking without sufficiently narrowing when external API calls should occur. In an agent environment, over-broad activation can lead to unnecessary transmission of user-provided logistics identifiers and accidental execution of networked actions when the user only wanted advice or formatting help.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill describes sending tracking numbers and, in some cases, phone-number suffixes to an external service and exporting detailed results to files, but it provides no privacy or data-handling warning to the user. This is dangerous because logistics records may contain sensitive personal or business information, and exporting them to xlsx/csv/txt/json increases the risk of secondary disclosure or insecure storage.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/express_query.py (reported line 311)May include surrounding context.

python

查询结果字典，包含每个单号的物流轨迹
    """
    # 构建请求参数
    url = "https://api.xdccy.com/IsvApi/GetXdccTrackInfoV2"
    timeout = 8

    # 逐个查询

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 71% confidence

Finding

整个技能说明仅以中文定义名称、描述、步骤、提示语和示例，没有说明是否支持其他语言，也未给出用户可选择输出语言的方式。若组织要求避免在无用户同意时强制特定语言，这种单一语言约束可能构成自然语言策略问题。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This markdown document is entirely written in Chinese and presents the format specification as mandatory without indicating any user language choice or opt-in. Under the stated policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.