Security audit

Trip.com TripGenie

Security checks for vulnerabilities and agentic risk

Overview

This travel skill appears purpose-built for Trip.com queries, but it is broad enough to capture general travel conversations and sends potentially sensitive travel details plus an API token to an external service with weak disclosure and unsafe local handling.

Install only if you are comfortable sending travel questions, itinerary details, locale information, and a TripGenie API token to Trip.com infrastructure. Configure the API key through a protected environment or secret manager rather than chat, avoid using the skill for casual travel discussion unless you intend a provider lookup, and treat returned links or booking details as third-party content to verify before acting.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:128
Finding: Untrusted Remote API Responses Are Forwarded Without Validation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:42
Finding: API Token Is Solicited Through Conversational Input
Content: View full analysis
" in OpenClaw web console. ``` ### Technical Analysis The setup instructions encourage users to submit an API token as ordinary conversational input. Chat messages may be retained in conversation history, application logs, telemetry, model context, browser state, support exports, or screenshots. A credential entered this way has a broader exposure surface than one stored through an environment variable or dedicated secret-management interface. The project metadata already identifies `TRIPGENIE_API_KEY` as the intended environment variable, making the conversational provisioning guidance unnecessary and unsafe. ### Attack Path 1. A user follows the setup instructions and pastes the TripGenie API token into the OpenClaw web console. 2. The token becomes part of the conversation or request payload. 3. The platform, browser, logging infrastructure, telemetry pipeline, or an administrator retains or processes the message. 4. A party with access to any retained copy obtains the token. 5. The exposed token is used to issue unauthorized requests to the TripGenie API until it expires or is revoked. ### Impact Assessment An attacker who obtains the token can act with the API permissions assigned to that credential. Depending on server-side authorization and rate limits, this may permit unauthorized API requests, quota consumption, access to token-associated functionality, or financial and operational abuse. The finding does not establish access to the local operating system or privileges beyond those granted to the stolen API token. Exposure scope includes every system that stores or processes the conversational message. ]]>
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:57
Finding: Predictable Shared Temporary Files Permit Symlink Clobbering and Data Exposure
Content: View full analysis
/tmp/tripgenie-result.md cat /tmp/tripgenie-result.md ``` ```bash jq -n --arg token "$TRIPGENIE_API_KEY" --arg departure "BJS" --arg arrival "SHA" --arg date "2026-03-15" --arg flight_type "1" '{token: $token, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type, query: $query}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- > /tmp/tripgenie-flight.md cat /tmp/tripgenie-flight.md ``` ```bash jq -n --arg token "$TRIPGENIE_API_KEY" --arg departure "FRA" --arg arrival "HKG" --arg date "2026-03-17" --arg flight_type "0" '{token: $token, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type,query: $query}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- > /tmp/tripgenie-flight.md cat /tmp/tripgenie-flight.md ``` ### Technical Analysis The commands redirect API responses to fixed paths in the shared `/tmp` directory. Predictable filenames can be pre-created by another local user as symbolic links or other filesystem objects. Standard shell redirection follows symbolic links, so execution under a more privileged or different account may overwrite another file writable by that account. The files may also retain travel queries, itineraries, prices, booking URLs, and related metadata after the command completes. The instructions do not create the files with restrictive permissions, verify their ownership or type, or delete th ...[truncated 1384 chars]
Remediation: View remediation
"$tmp_file" && cat -- "$tmp_file" ``` ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill declares itself the primary handler for all travel-related queries and tells the orchestrator to prefer it over generic alternatives. Those broad routing rules can capture ordinary travel conversation and send user prompts to a third-party API even when the user did not explicitly choose this provider, increasing privacy and unintended-action risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow states that user travel queries are POSTed to the TripGenie API and the full response is returned, but it does not clearly warn users that their query text and locale may be sent off-platform and written to a local file. This creates a transparency and privacy issue because users may disclose sensitive itinerary, identity, or booking details without informed consent.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 98% confidence
Finding: This command transmits the user's query, locale, and API token to an external Trip.com endpoint and writes the returned content to /tmp. In a travel skill this behavior is functionally expected, but it is still security-relevant because sensitive travel plans and associated metadata leave the local trust boundary and the output file may expose data to other local processes.
Content: Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.
| locale | No | Language/region; use LANG when available. |

bash
jq -n --arg token "$TRIPGENIE_API_KEY" --arg query "$USER_QUERY" --arg locale "$LANG" '{token: $token, query: $query, locale: $locale}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/query -H "Content-Type: application/json" -d @- > /tmp/tripgenie-result.md cat /tmp/tripgenie-result.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: The airline example posts travel details and the API token to an external service and stores the response in a predictable temporary file. Flight search data can reveal itinerary, location, and timing information, and predictable temp paths increase local disclosure risk on multi-user or shared environments.
Content: Scanner excerpt · SKILL.md (reported line 75)May include surrounding context.
China domestic flight search example:

bash
jq -n --arg token "$TRIPGENIE_API_KEY" --arg departure "BJS" --arg arrival "SHA" --arg date "2026-03-15" --arg flight_type "1" '{token: $token, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type, query: $query}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- > /tmp/tripgenie-flight.md cat /tmp/tripgenie-flight.md

External Transmission

Medium

Category: Data Exfiltration
Confidence: 97% confidence
Finding: This example has the same external transmission and temporary-file exposure pattern as the prior airline example. In context, international travel queries may be especially sensitive because they can reveal cross-border plans and personal movement patterns, so forwarding them as-is and storing responses locally raises privacy concerns.
Content: Scanner excerpt · SKILL.md (reported line 82)May include surrounding context.
International flight search example:

bash
jq -n --arg token "$TRIPGENIE_API_KEY" --arg departure "FRA" --arg arrival "HKG" --arg date "2026-03-17" --arg flight_type "0" '{token: $token, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type,query: $query}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- > /tmp/tripgenie-flight.md cat /tmp/tripgenie-flight.md

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases and keywords include generic terms like hotel, accommodation, lodging, flight, airline, and ticket. In this skill's context, broad matching can cause over-triggering and unnecessary transmission of user content to the external API, especially for casual discussion rather than booking intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: Automatically populating locale from the system LANG variable sends environment-derived regional information to the external API without explicit user choice. While low severity, it leaks contextual metadata and may also produce responses based on host settings rather than user preference.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 72% confidence
Finding: The parameter definition states that flight_type value 1 means domestic China and 0 means international/other, embedding a region-specific categorization in the skill behavior. Without a documented user-facing rationale or opt-in, this may impose a locale-specific assumption on flight search handling.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.