ClawHub
Back to skill

Security audit

Otto Travel Local

Security checks for vulnerabilities and agentic risk

Overview

This Otto Travel plugin is coherent for travel booking, but it gives a remote, configurable MCP server authenticated booking and account-management authority without enough endpoint validation or user-facing controls.

Review this before installing. Use only the default Otto HTTPS endpoint unless you fully trust a custom MCP server, because that server receives OAuth material and travel details. Treat the token file as sensitive, and require explicit confirmation in your workflow before any flight, hotel, preference, or loyalty-program change.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
index.ts:14
Finding

Unrestricted MCP Server URL Permits Plaintext Credential Transmission and Untrusted Tool Registration

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (20)

Known Vulnerable Dependency: fast-uri==3.1.0 — 7 advisory(ies): CVE-2026-13676 (fast-uri vulnerable to host confusion via failed IDN canonicalization); CVE-2026-18446 (fast-uri vulnerable to host confusion via backslash authority introducer); CVE-2026-75975 (fast-uri vulnerable to server-side request forgery via malformed IPv6 normalizat) +4 more

High
Category
Supply Chain
Confidence
90% confidence
Finding

fast-uri 3.1.0 has multiple advisories involving URI parsing ambiguities, host confusion, and possible SSRF edge cases. In a travel-booking integration that likely processes remote endpoints, redirects, or externally supplied URLs through SDK validation layers, URI misparsing can have significant security consequences if any trust decisions depend on parsed hosts.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: hono==4.12.9 — 16 advisory(ies): CVE-2026-56762 (Hono missing validation of cookie name on write path in setCookie()); CVE-2026-47676 (Hono: app.mount() strips mount prefix using undecoded path, causing incorrect ro); CVE-2026-47675 (Hono: Cookie helper does not sanitize sameSite and priority, allowing Set-Cookie) +13 more

High
Category
Supply Chain
Confidence
94% confidence
Finding

hono 4.12.9 is flagged by many advisories covering routing, cookie, and path handling issues. Because the MCP SDK depends on Hono for server behavior, flaws in request routing or header/cookie handling could affect exposed tool endpoints and make the plugin's network surface more dangerous than a purely local library would be.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High
Category
Supply Chain
Confidence
87% confidence
Finding

ip-address 10.1.0 includes advisories for address parsing discrepancies and an XSS issue in HTML-emitting methods. In this dependency chain it comes from express-rate-limit, so the main realistic concern is incorrect IP interpretation affecting security decisions such as rate limiting or network allow/deny logic if such functionality is enabled.

Content

No source excerpt is available for this finding.

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · src/auth.ts (reported line 53)May include surrounding context.

ts
}

  /**
   * Get a valid access token. Loads from disk, refreshes if expired,
   * or runs the full device auth flow if no tokens exist.
   */
  async getAccessToken(): Promise<string> {

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README explicitly states that OAuth access/refresh tokens are stored locally in a predictable path, but it does not warn that these credentials are sensitive or advise users to protect file permissions. If another local user, malware, or backup/sync process can read that file, the tokens could be reused to access the user's Otto account and perform travel-related actions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill exposes MCP and network-backed capabilities but does not declare any explicit tool scope, permissions, or allowed-tools boundaries. In a booking plugin, this weakens least-privilege controls and makes it easier for an agent to invoke sensitive actions such as reservations or account operations without clear policy constraints or user understanding.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill advertises flight and hotel booking but does not warn that these tools may create real reservations, spend loyalty points, or incur financial charges. In this context, omission is dangerous because users and agents may treat tool use as informational when it can trigger irreversible real-world transactions.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 32)May include surrounding context.

md
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 40)May include surrounding context.

md
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · README.md (reported line 62)May include surrounding context.

md
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 24)May include surrounding context.

md
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · index.ts (reported line 12)May include surrounding context.

ts
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

External Transmission

Medium
Category
Data Exfiltration
Confidence
50% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · openclaw.plugin.json (reported line 11)May include surrounding context.

json
"properties": {
      "serverUrl": {
        "type": "string",
        "description": "Otto MCP server URL (e.g. https://api.ottotheagent.com/mcp). Defaults to production."
      }
    }
  }

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
86% confidence
Finding

This code retrieves an access token and injects it into the Authorization header for every MCP request. While the top comment documents the behavior for developers, there is no user-facing disclosure, confirmation, or visible warning that credentials will be sent to a remote server.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @hono/node-server==1.19.11 — 2 advisory(ies): CVE-2026-39406 (@hono/node-server: Middleware bypass via repeated slashes in serveStatic); GHSA-frvp-7c67-39w9 (Node.js Adapter for Hono: Path traversal in `serve-static` on Windows via encode)

Low
Category
Supply Chain
Confidence
95% confidence
Finding

The lockfile pins @hono/node-server 1.19.11, which is reported to include path handling flaws such as repeated-slash middleware bypass and Windows serve-static path traversal. Even though this skill is a travel plugin and not obviously a file-serving app, the vulnerable package is present in the shipped dependency graph and could become exploitable if the SDK exposes affected server features.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: body-parser==2.2.2 — 1 advisory(ies): CVE-2026-12590 (body-parser vulnerable to denial of service when invalid limit value silently di)

Low
Category
Supply Chain
Confidence
84% confidence
Finding

body-parser 2.2.2 is flagged for a denial-of-service condition around invalid limit handling. As a transitive dependency of Express in the MCP SDK, it may be reachable if the skill accepts HTTP request bodies through the embedded server stack, making resource exhaustion plausible though likely limited.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: qs==6.15.0 — 3 advisory(ies): CVE-2026-82417 (qs: Denial of Service via Attacker Controlled isBuffer); CVE-2026-8723 (qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/u); CVE-2026-82562 (qs array-limit bypass via bracket-key comma parsing)

Low
Category
Supply Chain
Confidence
86% confidence
Finding

qs 6.15.0 is associated with multiple denial-of-service and parsing-bypass issues. Since qs is commonly used to parse query strings and request bodies in Express stacks, malformed attacker-controlled parameters could trigger excessive work or bypass intended array limits on exposed HTTP endpoints.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
90% confidence
Finding

The production dependency uses a caret range, which permits automatic installation of newer minor and patch releases. While common in JavaScript projects, this increases supply-chain risk because a compromised or breaking upstream release could be pulled in without explicit review, and this skill depends on an MCP SDK that may influence external tool interactions.

Content

Scanner excerpt · package.json (reported line 11)May include surrounding context.

json
"extensions": ["./index.ts"]
  },
  "dependencies": {
    "@modelcontextprotocol/sdk": "^1.25.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 14)May include surrounding context.

json
"@modelcontextprotocol/sdk": "^1.25.0"
  },
  "devDependencies": {
    "@types/node": "^22.0.0",
    "typescript": "^5.7.0"
  },
  "engines": {

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 15)May include surrounding context.

json
},
  "devDependencies": {
    "@types/node": "^22.0.0",
    "typescript": "^5.7.0"
  },
  "engines": {
    "node": ">=18.0.0"