携程笔记全自动发布

• Outcome: Review
• Latest audit: May 28, 2026 · 6:47 AM UTC
• Version: 1.0.0

Overview

This skill is for Ctrip posting, but it can control a logged-in Chrome session and modify a live publishing page with weak scoping and unclear confirmation boundaries.

Install only if you are comfortable letting this skill operate Chrome while logged into Ctrip. Use a separate browser profile if possible, review all generated text and images yourself, and do not allow final publishing unless you explicitly approve the exact post.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

activate
        end tell
        '''
        subprocess.run(['osascript', '-e', script])
        time.sleep(2)
        
    def navigate_to_publish_page(self):

• Confidence: 82% confidence
• Finding: The script uses AppleScript to control the user's existing Chrome session and activate/create windows without any consent gate. In the context of an agent skill, browser automation against the user's live session can manipulate authenticated web apps and interfere with unrelated tabs, which creates a real integrity and privacy risk even though the script is not overtly malicious.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
        end tell
        '''
        result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True)
        if result.returncode != 0:
            print(f"⚠️ 导航警告: {result.stderr}")
        print("🚀 已导航到携程发布页面")

• Confidence: 86% confidence
• Finding: This AppleScript navigates the active tab of the user's first Chrome window to a publishing page, potentially disrupting an existing browsing session and operating within an authenticated account context. In a skill that automates content posting, taking over a real browser tab materially increases the risk of unintended actions on behalf of the user.

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

end tell
        end tell
        '''
        result = subprocess.run(['osascript', '-e', script], capture_output=True, text=True)
        return result.stdout.strip()
        
    def fill_title(self, title):

• Confidence: 94% confidence
• Finding: The function executes arbitrary JavaScript in the active tab via AppleScript, and several callers interpolate `title`, `content`, and `destination` directly into that JavaScript. If those values come from external input, an attacker can break out of the intended string context and run unintended script in the authenticated Ctrip page, potentially causing unauthorized form manipulation or actions.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill describes network access, local file writes to /tmp/openclaw/uploads/, and execution of browser automation/CDP-based code, but it does not declare corresponding permissions or safety boundaries. Undeclared capabilities are dangerous because users and hosting platforms cannot accurately assess what the skill may access or modify, especially when it can download external content and drive a logged-in browser session to publish content.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence
• Finding: The skill claims fully automatic publishing, image search, upload, and publish-button execution, but the finding indicates the actual implementation does not fully perform those actions and has undisclosed platform constraints. This mismatch is security-relevant because users may grant trust or approvals based on inaccurate claims, causing unsafe assumptions about what the automation will do, how it runs, and what manual review steps are skipped.

Vague Triggers

Medium

• Confidence: 80% confidence
• Finding: The trigger phrases include broad everyday requests such as '发布到携程' and '帮我发到携程', which can overlap with normal conversation and unintentionally invoke a high-impact publishing workflow. Because this skill can automate content creation and submission in a logged-in account, accidental triggering increases the chance of unauthorized or unintended posts.

Missing User Warnings

High

• Confidence: 96% confidence
• Finding: The skill advertises automatic downloading of images, uploading them, and clicking the publish button, but it does not describe any mandatory user confirmation, preview, or risk warning before taking those irreversible external actions. In the context of a logged-in travel platform account, this can lead to unauthorized posting, copyright/compliance issues from externally sourced images, and reputational damage from publishing incorrect or unreviewed content.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The description '携程笔记发布技能' is overly broad and does not clearly limit when the skill should be invoked or what user authorization and content constraints apply. For an automation skill that can search images, fill content, upload media, and publish posts, vague metadata increases the chance of unintended or overly broad activation, which can lead to unauthorized posting, spammy behavior, or misuse in the wrong context.

Static analysis

No suspicious patterns detected.