中文 EN

Scan Report

Scan New Files

✓ Trusted — Risk Score 5/100
Last scan:22 hr ago Rescan
5 /100
shippo-official
Multi-carrier rate shopping, label generation, package tracking, address validation, customs declarations, and batch processing from CSV files
A legitimate, documentation-only shipping skill using the Shippo API via a documented MCP server. No scripts, code, or hidden functionality. All capabilities are declared in SKILL.md.
Skill Nameshippo-official
Duration33.3s
Enginepi
✓
Safe to install
Approve for use. The skill's functionality (address validation, rate shopping, label purchase, tracking, batch processing) is fully documented and operationally appropriate for a shipping integration.

Findings 1 items

Severity Finding Location
Low
Third-party MCP endpoint access Priv Escalation
The skill routes all API requests through an external MCP server at app.getgram.ai. This server is the documented Shippo MCP beta integration, but it introduces a third-party dependency for routing API calls. The SHIPPO_API_KEY is sent as a header to this endpoint.
MCP server: https://app.getgram.ai/mcp/shippo-mcp-beta
→ This is operationally necessary for the MCP architecture. The endpoint is clearly declared and appears to be the official Shippo MCP integration. No evidence of data exfiltration beyond Shippo API traffic.
 SKILL.md:22
ResourceDeclaredInferredStatusEvidence
Filesystem NONE NONE — No file operations found; documentation-only
Network READ READ ✓ Aligned SKILL.md:22 — MCP server https://app.getgram.ai/mcp/shippo-mcp-beta
Shell NONE NONE — No shell scripts or subprocess calls found
Environment READ READ ✓ Aligned SKILL.md:metadata — requires SHIPPO_API_KEY only
Skill Invoke READ READ ✓ Aligned MCP tools defined in references/tool-reference.md
Clipboard NONE NONE — No clipboard access documented or present
Browser NONE NONE — No browser automation documented or present
Database NONE NONE — No database operations documented or present
2 findings
🔗
Medium External URL 外部 URL
https://app.getgram.ai/mcp/shippo-mcp-beta
SKILL.md:22
📧
Info Email 邮箱地址
[email protected]
references/csv-format.md:60

File Tree

5 files · 52.3 KB · 1239 lines
Markdown 5f · 1239L
├─ ▾ 📁 references
│ ├─ 📝 carrier-guide.md Markdown 136L · 5.6 KB
│ ├─ 📝 csv-format.md Markdown 106L · 5.8 KB
│ ├─ 📝 customs-guide.md Markdown 227L · 9.1 KB
│ └─ 📝 tool-reference.md Markdown 404L · 15.0 KB
└─ 📝 SKILL.md Markdown 366L · 16.7 KB

Security Positives

✓ Documentation-only skill — no executable code, scripts, or binaries present
✓ All capabilities fully declared in SKILL.md and reference documents
✓ No obfuscation, base64, or anti-analysis patterns detected
✓ No credential harvesting beyond the declared SHIPPO_API_KEY
✓ No filesystem write, shell execution, or persistence mechanisms
✓ No sensitive path access (no ~/.ssh, ~/.aws, .env inspection)
✓ No C2 communication, reverse shell, or data exfiltration patterns
✓ Comprehensive user confirmation gates before label purchases
✓ Clear test vs. live mode distinction with API key prefix checking
✓ No supply chain risk — no dependencies or package manager files