T09 · Insecure Skill Coding Practices
Error
- Location
config.json:2- Finding
Hardcoded Kuaidi100 API Credentials and Phone Suffix in Version-Controlled Configuration
- Content
View full analysis
- Remediation
View remediation
Security audit
快递查询
Security checks for vulnerabilities and agentic risk
Overview
The parcel-tracking feature is mostly coherent, but the package also ships plaintext credentials and an unrelated publisher script that can use a home-directory EvoMap secret.
Review before installing. Remove publish_evomap.py from the distributed skill unless you intentionally want EvoMap publication tooling, rotate the exposed Kuaidi100 credentials, replace config.json with a non-secret template or environment-based configuration, and add a clear notice before sending shipment numbers or phone suffixes to Kuaidi100.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
publish_evomap.py:14- Finding
Undocumented Home-Directory Credential Access and Authenticated EvoMap Publication
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (12)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
This is a serious description-behavior mismatch: the skill claims to perform package tracking, but the detected code behavior includes reading a local secret from
~/.evomap/node_secret, constructing metadata, and performing authenticated remote publishing. Those actions are unrelated to shipment lookup and strongly suggest hidden credential access and exfiltration or unauthorized remote operations.- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest describes a skill that queries package logistics status for users, but this file does not implement any tracking lookup logic. Instead, it constructs Gene/Capsule/EvolutionEvent metadata and publishes them to EvoMap over the network, which is a different operational purpose than express tracking itself.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 74% confidence
- Finding
The skill declares no explicit tool scope even though its documented behavior clearly requires reading local configuration and making outbound network requests. Missing scope declarations weaken reviewability and sandbox enforcement, increasing the chance that the skill accesses capabilities users and operators did not knowingly approve.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The manifest says the skill triggers when the user asks about delivery status, logistics information, or package location, but it does not define specific trigger phrases or exclusion conditions. Phrases like asking about a package's location are common in general conversation and could cause unintended activation without clearer scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill does not clearly warn users that tracking numbers and possibly phone suffixes will be sent to an external API provider. Shipment identifiers can be sensitive personal data, so undisclosed transmission creates a privacy risk and undermines informed consent.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 77% confidence
- Finding
The file-level documentation says this module publishes the express tracking skill to EvoMap, while the embedded Capsule content and summaries describe a skill that receives tracking numbers, calls the 快递100 API, and formats logistics results. This file never performs those documented runtime actions, creating intent confusion between deployment metadata and actual code behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This Python file contains multiple natural-language strings in Chinese, including the module docstring, comments, summaries, and capsule content. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which is not present here.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script reads a long-lived local node secret from disk and uses it to perform authenticated publication to a remote service, which is unrelated to end-user parcel queries. In a skill package context, embedding publisher behavior increases the blast radius: anyone running the skill may unknowingly trigger privileged outbound actions using local credentials.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool defaults are unsafe or overly permissive (e.g. disabled TLS verification, no authentication, world-writable permissions). Unsafe defaults widen the attack surface.
- Content
python "payload": payload } def post(endpoint, data, use_auth=False): """发送 POST 请求""" url = f"{HUB_URL}{endpoint}" headers = {"Content-Type": "application/json"}
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The script sends tracking numbers and, in some cases, a recipient phone number to the external kuaidi100 API without any explicit disclosure, consent flow, or minimization controls. In this skill context, shipment identifiers and phone data are user-linked logistics information, so silent transmission to a third party creates a real privacy and data-handling risk even though it is necessary for the feature to function.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 71% confidence
- Finding
The natural-language description and usage guidance are entirely in Chinese, and there is no indication that the user can choose another language or that the skill is intentionally restricted to a Chinese-language audience. This can conflict with language or locale policies when skills are expected to avoid forcing a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-facing strings such as the description, errors, and usage output are all fixed in Chinese, with no option for users to select another language. This can violate language/locale policy when a skill forces a specific language without opt-in or explicit justification.
- Content
Static analysis
No suspicious patterns detected.