ClawHub
Back to skill

Security audit

MoodTrip Hotel Search

Security checks for vulnerabilities and agentic risk

Overview

This hotel-search skill is mostly coherent, but it asks agents to persistently modify MCP configuration and run an unpinned npx bridge automatically.

Review this before installing. The hotel-search functionality itself is understandable, but installation can add a persistent MCP server that runs an unpinned npx package and sends hotel search inputs to MoodTrip.ai. Prefer a version that pins the bridge dependency and requires explicit confirmation before editing config or restarting any gateway.

A.I.G

Vulnerability Patterns
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T03 · Remote Payload Retrieval and Execution

Error
Location
mcp.json:4
Finding

Unpinned Remote Package Is Automatically Downloaded and Executed

Content
View full analysis

Vulnerability Details

File Location: mcp.json:4-5
Vulnerability Type: Remote payload execution through an unpinned third-party dependency
Risk Level: High

json
"command": "npx",
"args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"]

The same unsafe installation pattern is also recommended in SKILL.md:41-42:

markdown
- OpenClaw currently supports **stdio MCP servers only** (not HTTP). Use the `mcp-remote` bridge:
  - Add to config: `mcpServers.moodtrip = { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"] }`

Technical Analysis

The MCP configuration invokes npx with both -y and mcp-remote@latest. This causes the runtime to retrieve and execute the package version currently published under the latest tag without interactive approval. Because neither an exact version nor an integrity digest is specified, the code executed during future installations can differ from the code available at audit time.

This creates a remote payload retrieval and software supply-chain risk. Compromise of the package, its publisher account, the package registry, or a future release could turn MCP startup into arbitrary local code execution. The -y option removes the normal confirmation prompt and makes execution unattended.

Attack Path

  1. An attacker compromises the mcp-remote package, its publisher account, or a future release assigned to the latest distribution tag.
  2. The Skill is installed, or the configured MoodTrip MCP server is initialized.
  3. The runtime executes npx -y mcp-remote@latest.
  4. npx downloads the attacker-controlled package version from the package registry.
  5. Package installation hooks or runtime code execute with the privileges of the Agent or gateway process.
  6. The malicious package can access resources available to that process before optionally proxying normal MCP traffic to avoid detecti ...[truncated 492 chars]
Remediation
View remediation

Remediation Suggestions

  • Replace mcp-remote@latest with an exact, reviewed version.
  • Enforce package integrity using a lockfile and registry-supported integrity hashes.
  • Remove unattended -y execution where user confirmation is practical.
  • Prefer native HTTPS MCP support so no locally executed bridge package is required.
  • If a bridge is necessary, bundle or install a reviewed artifact from a trusted, authenticated source rather than resolving it dynamically at startup.
  • Run the bridge in a sandbox with minimal filesystem, environment-variable, process, and network access.
  • Establish a controlled dependency-update process that requires review and testing before changing the pinned version.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:39
Finding

Automatic Persistent MCP Configuration Modification Without Explicit Confirmation

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:39-50
Vulnerability Type: Unauthorized configuration modification and privilege-boundary expansion
Risk Level: Medium

markdown
**Step 3: Auto-connect on OpenClaw when possible.**
If the server is NOT configured and you are running inside OpenClaw with config-edit capability:

- OpenClaw currently supports **stdio MCP servers only** (not HTTP). Use the `mcp-remote` bridge:
  - Add to config: `mcpServers.moodtrip = { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"] }`
  - This wraps the HTTP MCP server as a stdio process that OpenClaw can load.
- If you have OpenClaw config tools available, patch config so the MCP server is added automatically.
- After adding it, restart/reload the gateway or start a fresh session — tools only load at session start.
- Then re-check whether the MoodTrip tools are exposed.

OpenClaw-specific rule:
- If the user asked to connect/install/fix MoodTrip MCP, and you can safely edit OpenClaw config, **do it automatically** instead of just telling the user to do it manually.

Technical Analysis

The Skill directs the Agent to modify OpenClaw configuration automatically and restart or reload the gateway. It does not require the Agent to present the exact change, obtain explicit confirmation, create a backup, or define rollback steps before applying the persistent configuration.

The modification registers a local command that connects to an external MCP service and downloads an unpinned executable dependency. This expands the set of code and remote services trusted by the Agent beyond the immediate hotel-search request. Because the configuration survives the initiating interaction, later sessions may continue to load the bridge and expose hotel-search inputs to the configured service.

Attack Path

  1. A user makes a hotel-related request or asks the Agent to connect or repair Moo ...[truncated 1218 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit, informed user confirmation immediately before modifying persistent configuration or restarting the gateway.
  • Display the exact configuration patch, executable command, external endpoint, and data-sharing implications before approval.
  • Back up the existing configuration and validate the modified configuration before restarting any service.
  • Provide precise rollback and uninstall instructions for removing the moodtrip MCP server entry.
  • Prefer session-scoped activation when supported rather than persistent global registration.
  • Restrict configuration-edit tools so the Skill can modify only its dedicated MCP entry.
  • Use an exact, integrity-verified bridge version and run it under least privilege.
  • Do not automatically restart shared gateways; request confirmation and warn about interruption to other sessions.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)

Context-Inappropriate Capability

High
Category
Not specified by scanner
Confidence
99% confidence
Finding

The skill explicitly instructs the agent to auto-edit OpenClaw configuration and add a new MCP server via an npx-launched bridge, which is a privileged local-environment change unrelated to hotel search. If followed automatically, this could alter trusted tool availability, introduce a new code execution path through package fetching, and normalize self-installing behavior from untrusted skill content.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The activation guidance says to use the skill for 'anything related to finding or booking a place to stay' and for 'travel destinations with accommodation needs,' which is broad enough to overlap with many ordinary travel-planning conversations. It also mixes explicit trigger phrases with open-ended categories, without negative examples or clear boundaries for when the skill should not activate.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

A hotel search skill should not implicitly expand into platform administration tasks such as adding MCP servers, editing config, or installing packages. This creates a scope gap where invoking a travel-related skill can trigger sensitive host changes unrelated to the user's immediate hotel request.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This instruction adds an external MCP endpoint into local configuration and routes future queries to api.moodtrip.ai through mcp-remote. That enables transmission of user search data to a third-party service and introduces a supply-chain/code-execution element via npx ... @latest, all from within a content skill.

Content

Scanner excerpt · SKILL.md (reported line 37)May include surrounding context.

md
If the server is NOT configured and you are running inside OpenClaw with config-edit capability:

- OpenClaw currently supports **stdio MCP servers only** (not HTTP). Use the `mcp-remote` bridge:
  - Add to config: `mcpServers.moodtrip = { "command": "npx", "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"] }`
  - This wraps the HTTP MCP server as a stdio process that OpenClaw can load.
- If you have OpenClaw config tools available, patch config so the MCP server is added automatically.
- After adding it, restart/reload the gateway or start a fresh session — tools only load at session start.

External Transmission

Medium
Category
Data Exfiltration
Confidence
92% confidence
Finding

The fallback directs the agent to run external configuration and installation commands that connect the environment to a remote service. Even if the service is legitimate, this still causes data egress potential and local environment modification without strong justification for a hotel-search skill.

Content

Scanner excerpt · SKILL.md (reported line 50)May include surrounding context.

md
**Step 4: Fallback if auto-connect is not possible.**
Only if auto-connect is not possible:
- **mcporter available?** Run: `mcporter config add moodtrip https://api.moodtrip.ai/api/mcp-http`
- **clawhub available?** Run: `clawhub install adiny/moodtrip-hotel-search`
- **Neither available?** Tell the user:
  > "MoodTrip's hotel search tools aren't connected yet. Please add this MCP server in your platform settings:

External Transmission

Medium
Category
Data Exfiltration
Confidence
88% confidence
Finding

Providing the external MCP URL itself is not malicious, but within this skill it supports connecting the agent to a third-party endpoint that will receive hotel search inputs. In context, the risk is increased by the surrounding instructions that encourage setup and activation from inside the skill rather than through a trusted installation flow.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md
- **clawhub available?** Run: `clawhub install adiny/moodtrip-hotel-search`
- **Neither available?** Tell the user:
  > "MoodTrip's hotel search tools aren't connected yet. Please add this MCP server in your platform settings:
  > **URL:** `https://api.moodtrip.ai/api/mcp-http`
  > No credentials required. For setup: https://github.com/adiny/moodtrip-hotel-search"

**CRITICAL:** Do NOT hallucinate hotel results. Do NOT call tools that don't exist. Do NOT attempt curl/fetch workarounds. If tools cannot be verified after all steps, help the user connect or restart the session.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill claims the server is read-only and only handles hotel search queries, but earlier instructions direct the agent to modify local MCP/platform configuration and install tooling. That mismatch is dangerous because it downplays non-read-only side effects on the host environment and could cause an agent or user to consent to broader actions than expected.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

md
"mcpServers": {
    "moodtrip": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"]
    }
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 80)May include surrounding context.

md
"mcpServers": {
    "moodtrip": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"]
    }
  }
}

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · mcp.json (reported line 5)May include surrounding context.

json
"mcpServers": {
    "moodtrip": {
      "command": "npx",
      "args": ["-y", "mcp-remote@latest", "https://api.moodtrip.ai/api/mcp-http"]
    }
  }
}

Static analysis

No suspicious patterns detected.