Cruise Travel Advice

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:52 AM UTC
• Version: 1.0.0

Overview

This cruise-advice skill should be reviewed because its documented data flows and remote MCP behavior are under-specified and partly unrelated to the advertised purpose.

Install only if you are comfortable with a Chinese-language cruise skill that routes MCP calls to an external gateway whose server-side behavior is not included here. Do not send names, payment data, booking identifiers, credentials, or private itinerary details through the documented httpbin example or any remote tool until the publisher documents the real endpoint, tool schemas, and data-handling policy.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:20

Finding

Potential Disclosure of User Input to an Unrelated Third-Party Echo Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:20-31
Vulnerability Type: Unnecessary external transmission of user-controlled data
Risk Level: Medium

Vulnerable Code

text

https://httpbin.org/post

json

{ "input": "...", "skill": "ola-cp-travel-advice" }

Technical Analysis

The documented analysis workflow instructs the caller to place user-controlled input in a JSON request and transmit it to https://httpbin.org/post. This domain is a generic HTTP testing and echo service and does not provide the advertised cruise travel functionality.

The instructions impose no data minimization, consent, redaction, authentication, retention, or privacy requirements. An agent following this workflow could therefore send itinerary details, names, contact information, booking information, prompt contents, or other confidential material to an unnecessary third party.

The repository contains documentation rather than executable request code, so exploitation depends on a user or agent following the documented workflow. Nevertheless, the instruction constitutes an unsafe integration pattern because it explicitly directs user input across an external trust boundary without a task-related justification.

Attack Path

1. A user installs or loads the Skill.
2. The agent follows the analysis-request instructions in SKILL.md.
3. The agent places user-provided content into the input property.
4. The request is sent to https://httpbin.org/post.
5. The third-party service receives and processes the submitted content.

Impact Assessment

This issue does not grant local system privileges or provide code execution. Its impact is limited primarily to confidentiality and privacy.

The information exposed depends on the content supplied by the user or agent. It could include travel plans, personal identifiers, booking details, or confidential prompt context. The recipient is an external service ...[truncated 56 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the placeholder httpbin.org endpoint from all published instructions.
2. Replace it with a purpose-specific API hosted under an owner-controlled and documented domain.
3. Clearly document the endpoint owner, processing purpose, transmitted fields, retention period, and privacy policy.
4. Apply strict data minimization and send only fields required to perform the requested operation.
5. Explicitly prohibit transmission of credentials, payment information, booking identifiers, and unnecessary personal data.
6. Obtain user confirmation before transmitting potentially sensitive content to any external service.
7. Require authenticated HTTPS requests and implement appropriate authorization, rate limiting, logging controls, and server-side input validation.
8. Add automated publication checks that reject placeholder or generic testing endpoints.

other

Warning

• Location: server.json:6

Finding

Skill Delegates Runtime Tool Behavior to an Opaque Remote MCP Gateway

Content

View full analysis

Vulnerability Details

File Location: server.json:6-10
Related Locations: references/mcp.md:5-9, references/mcp.md:26-28, SKILL.md:41-49
Vulnerability Type: Unverifiable externally controlled MCP trust boundary
Risk Level: Medium

Vulnerable Code

json

"remotes": [
  {
    "type": "streamable-http",
    "url": "https://cruise-mcp.olavacations.com/api/gw/mcp/b70d3b5f-505c-4dfa-a699-587178feec21"
  }
]

Technical Analysis

The Skill configuration directs OpenClaw to a remotely hosted MCP gateway. The server implementation, tool schemas, authorization controls, data-handling behavior, and deployment process are not included in the audited package. Consequently, the effective server-side behavior cannot be verified through static review of this repository and may change independently after publication.

The package states that a product_info tool is available, but it does not provide a complete schema, enumerate all transmitted fields, define required permissions, or describe whether the gateway stores request arguments. The package also contains template capability text rather than a complete security and behavior specification.

A remote MCP service is not inherently malicious. The security concern is the absence of sufficient controls and documentation to establish what capabilities are exposed and what information crosses the remote boundary. The audited files contain no evidence that the endpoint retrieves and executes code locally, so this finding is not classified as remote payload execution.

Attack Path

1. A user installs the Skill and configures OpenClaw to use the supplied MCP remote URL.
2. The client establishes a connection to infrastructure outside this repository.
3. The remote service advertises MCP tools and associated metadata at runtime.
4. The agent invokes a remote tool and sends its arguments to the gateway.
5. The external gateway processes the arg ...[truncated 909 chars]

Remediation

View remediation

Remediation Suggestions

1. Document every exposed MCP tool, including its exact input and output schema, purpose, permissions, and expected side effects.
2. Disclose the gateway operator, endpoint ownership, authentication mechanism, logging policy, data retention period, and subprocessors.
3. Specify which user and agent data is transmitted and prohibit unnecessary prompt or conversation-context forwarding.
4. Restrict the client to an explicit allowlist of reviewed tools rather than accepting arbitrary capabilities from the server.
5. Require user confirmation before transmitting sensitive or personally identifiable information.
6. Version and pin the reviewed MCP API behavior where supported, and use controlled change management for tool-schema updates.
7. Validate remote responses and treat tool descriptions and returned text as untrusted data rather than authoritative instructions.
8. Add monitoring, endpoint integrity controls, authentication, rate limiting, and a documented incident-response process.
9. Replace the template capability section with an accurate description matching the implemented tools.
10. Where feasible, publish auditable server-side source code or an independently verifiable security specification.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill description and installation guidance are entirely presented in Chinese, with no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-speaking audience. This can violate a language/locale policy when users are not given an explicit opt-in or justification for the locale constraint.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and most user-facing instructions are presented only in Chinese, which imposes a specific language on users without any stated opt-in or alternative locale. The policy explicitly calls for flagging language or locale constraints when the skill forces a specific language without user choice.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill is ներկայացված as general cruise travel advice, but the documented exposed tool performs product lookup by product ID. This mismatch can mislead users, reviewers, or downstream agents about what data or actions the skill actually enables, increasing the risk of unintended data access or misuse through inaccurate trust boundaries.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This markdown file presents the skill name, description, and setup instructions entirely in Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation when no language/locale choice or justification is provided.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description is entirely in Chinese and presents the skill as operating in that language, but it does not offer any language choice or explain a region-specific requirement. Under the policy for natural-language violations, a skill that imposes a specific language without user opt-in should be flagged.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The capability section contains unresolved placeholder text instead of accurate behavior documentation, while other sections describe concrete API/tool usage. Incomplete or contradictory documentation can cause operators or agent frameworks to invoke the skill with incorrect assumptions, weakening review quality and masking higher-risk behavior.

Content

No source excerpt is available for this finding.