China Travel Guide

• Outcome: Pass
• Latest audit: Sep 12, 2026 · 8:38 AM UTC
• Version: 1.0.0

Overview

This is a static China travel guide skill with some broad triggers and outdated travel data, but it does not show hidden code, persistence, credential access, or destructive behavior.

Install this as a China-specific travel assistant, not a general emergency, navigation, or translation skill. Confirm that the user is actually asking about China before relying on it, and verify visa rules, emergency contacts, hospital details, transport prices, and app/payment limits with official or current sources before travel.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match

Content

# China Travel Guide

## Metadata

```yaml
name: China Travel Guide
version: 1.0.0
author: OpenClaw Team
description: Professional AI companion for foreign travelers in China - from pre-arrival preparation to emergency assistance
category: travel
language: en
target_audience: 
  - Foreign tourists planning to visit China
  - Backpackers and independent travelers
  - Cultural explorers
  - Long-term visitors (30+ days)
entry_points:
  - "planning to visit China"
  - "first time to China"
  - "China visa"
  - "help"
  - "emergency"
  - "translate this"
  - "how to get to"
  - "payment failed"
  - "recommend a route"
tools_required:
  - web_search
  - image_analysis
```

---

## System Instructions

• Confidence: 80% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The metadata sets "language: en", which indicates a fixed language/locale behavior. The file does not offer a user language choice or explain why English-only output is required, creating a potential language policy issue.

Vague Triggers

Medium

• Confidence: 98% confidence
• Finding: The entry point "help" is extremely broad and likely to match many unrelated conversations, causing unintended skill invocation and response hijacking. In an agent ecosystem, this can override more appropriate skills or inject travel-specific guidance into non-travel contexts, reducing reliability and potentially misrouting urgent requests.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The trigger "emergency" is too generic for a specialized travel skill and may activate during unrelated safety, medical, or security conversations. Because this skill provides country-specific emergency advice, accidental invocation could surface China-specific numbers or procedures when the user is elsewhere, creating confusion in time-sensitive situations.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The phrase "translate this" is a common general-purpose request and overlaps heavily with ordinary translation tasks outside this skill's intended scope. This can cause unnecessary invocation of a travel-specific skill, exposing irrelevant assumptions such as Chinese-language context or tourism workflows and degrading routing accuracy.

Vague Triggers

Medium

• Confidence: 96% confidence
• Finding: The module trigger "how to get to" is a highly common navigation phrase that appears in many everyday contexts unrelated to China travel. Broad matching increases the chance of accidental routing to this skill, which may then provide location-specific assumptions, transportation advice, or tool usage inappropriate for the user's actual setting.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: This JSON includes natural-language fields stating that some emergency services are available only in English in major cities or only in Chinese. Because the file presents language constraints directly and does not include any opt-in, alternatives, or justification text, it may conflict with the policy against forcing a specific language/locale without user choice.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: This JSON includes a fixed phrase stating 'I don't speak Chinese,' which bakes in a specific language assumption rather than offering language selection or opt-in. Under the policy for natural-language violations, forcing a specific language context without user choice can be a locale/language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The file repeatedly frames all routes exclusively around China-specific content, and line L007 explicitly uses the phrasing 'Chinese Civilization' as a fixed cultural/locale framing. Under the policy for natural-language violations, locale constraints should either offer user choice or be clearly documented as justified; this JSON provides no such opt-in or justification metadata.

Static analysis

No suspicious patterns detected.