ClawHub
Back to skill

Security audit

MoodTrip Hotel Search

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate hotel-search skill, but it needs Review because it can change the user's MCP/OpenClaw setup and run an unpinned npm bridge to a third-party service.

Install only if you are comfortable sending hotel-search details to MoodTrip and adding a remote MCP server. Approve any OpenClaw/MCP config changes yourself, prefer a pinned `mcp-remote` version instead of `latest`, and avoid entering unnecessary personal, payment, or account information.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Description-Behavior Mismatch

Medium
Confidence
97% confidence
Finding
The skill materially exceeds its stated hotel-search purpose by instructing the agent to edit local OpenClaw/MCP configuration, install packages, and restart services. Even if intended to improve usability, these actions change the host environment and can be abused to establish or expand an external integration without clear user approval, increasing the attack surface beyond normal read-only hotel lookup.

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The privacy section claims the tools are read-only and that no data is modified, but earlier sections direct the agent to patch local config and install/connect external tooling. This mismatch can mislead users or platform operators into underestimating the real capabilities and side effects of the skill, weakening informed consent and security review.

Vague Triggers

High
Confidence
89% confidence
Finding
The trigger language is overly broad and can activate the skill for general travel, lodging, destination, or booking discussions that do not require this external integration. Over-triggering increases the chance the agent will unnecessarily route benign conversations into a skill that encourages connecting to a third-party MCP server, causing avoidable data exposure and tool-use escalation.

Static analysis

No suspicious patterns detected.