Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Security audit
Hna 666 Flight Checker
Security checks for vulnerabilities and agentic risk
Overview
This skill automates Hainan Airlines 666Plus flight availability searches and its browser/network behavior matches that stated purpose, with some disclosure and portability issues users should understand.
Install only if you are comfortable with a Chinese-language skill launching Playwright, visiting Hainan Airlines' mobile query page, and submitting automated searches for your selected dates across the configured destinations. Review the airline site's terms and expect the hardcoded local path and Playwright environment to need adjustment.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (13)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is a travel-related flight benefits query tool for Hainan Airlines 666Plus. However, the supplied code only implements a standalone debug/logging helper with functions for info/debug/error output and a debug toggle. This is not a supporting detail tied to visible flight-query logic in the provided chunk; it is an unrelated utility module by itself. Therefore, the code chunk does not accurately represent the declared description.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains natural-language documentation in Chinese and all visible console messages are hardcoded in Chinese, indicating the skill is designed to operate in a single language without offering user opt-in or locale selection. The policy explicitly flags language or locale restrictions when a skill forces a specific language without user choice.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains user-facing natural-language strings and documentation entirely in Chinese, including runtime status messages such as the debug-mode notification. Under the stated policy, forcing a specific language without user opt-in is a locale/language policy violation unless the regional constraint is explicitly documented and justified, which is not present here.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language descriptions, logs, and class/docstring naming are exclusively in Chinese, signaling a fixed language/locale for interaction and output. There is no indication that users can choose another language or that the Chinese-only constraint is a documented, region-specific requirement.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The browser is launched with an automation-evasion flag and the script later falls back to forced JavaScript clicking to interact with the site. In a consumer skill context, deliberately masking automation and bypassing normal UI interaction is risky because it can circumvent site bot-detection expectations, obscure the automated nature of the traffic, and make abusive or policy-violating use easier without the user's informed consent.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
Docstrings and user-facing print messages throughout the file are exclusively in Chinese, including the class description and runtime status output. Under the stated policy, forcing a specific language without offering an alternative or opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This Python file contains module docstrings, class docstrings, labels, and print messages entirely in Chinese, indicating the skill is designed to operate in a single language. Under the policy rule, forcing a specific language without offering a user choice or documenting a justified regional constraint is a natural-language policy concern.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This Python file contains user-facing natural-language comments and labels exclusively in Chinese, such as the module docstring and destination names, with no indication that language selection is optional. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This code navigates to an external airline website and repeatedly submits flight queries across many destinations, which transmits user-selected travel dates and route selections over the network. Although the script prints progress messages, it does not explicitly disclose that it will contact a third-party site or perform bulk automated requests.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This code file performs a browser navigation to QUERY_URL, which is a network action, but the method contains no user-facing warning about connecting to an external site. Although there are debug prints for later UI actions, they do not disclose that the skill is transmitting browsing requests to a remote service.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This code presents its description, CLI help text, and user-facing output in Chinese only, which imposes a specific language on users without any visible opt-in or alternative locale support. The policy explicitly allows locale constraints only when documented and justified, which is not shown here.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The file’s natural-language content is entirely in Chinese, including the module docstring and function docstrings, with no indication that the skill is region-specific or that language choice is optional. This can violate language/locale policy when users or maintainers are not given a documented opt-in or alternative.
- Content