China Attraction Tickets

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 2.1.1

Overview

The skill is a coherent China travel assistant, but it sends itinerary and booking queries to a hardcoded external proxy using an embedded shared token.

Review this before installing if users may enter sensitive travel plans, budgets, or preferences. The skill does not show local persistence or destructive behavior, but it sends queries to a third-party proxy and ships with an embedded shared proxy token that should be rotated and moved out of source code.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/china_travel.py:24

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 24–37
Vulnerability Type: Hardcoded authentication credential
Risk Level: High

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },

Technical Analysis

The source code embeds a reusable proxy authentication token and its associated service endpoint. Because the script is distributed as part of the skill package, any party with access to the package can extract the token without executing the skill.

Although SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, the implementation does not read those variables. It instead uses hardcoded values for every request. Packaging configuration therefore provides no protection for the exposed credential.

The token is transmitted over HTTPS, which protects it in transit under normal TLS assumptions, but encryption in transit does not mitigate disclosure from source code. The remote service's token scope, quotas, and authorization policy are not visible in the audited files, so broader privileges cannot be established from the available evidence.

Attack Path

1. Obtain or inspect the distributed skill package.
2. Open scripts/china_travel.py and extract the endpoint and PROXY_TOKEN constants.
3. Construct an HTTPS POST request to the hardcoded Tencent SCF endpoint.

...[truncated 763 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed token immediately; assume it has been compromised.
2. Remove the token from source code and repository history.
3. Read the endpoint and credential from protected environment variables or a secrets manager, consistent with the declarations in SKILL.md.
4. Fail closed when required configuration is absent rather than falling back to embedded credentials.
5. Assign a narrowly scoped credential that authorizes only the required proxy operations.
6. Apply server-side rate limits, request validation, quotas, expiration, and token rotation.
7. Where feasible, bind credentials to specific clients or short-lived sessions instead of distributing a shared static token.
8. Review proxy logs for historical misuse of the exposed token.
9. Add secret scanning to development and release pipelines to prevent credentials from being packaged again.
10. Avoid including secret values in logs, exceptions, test fixtures, or generated artifacts.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill exposes the bash tool and explicitly instructs running a Python script that sends user queries to an external proxy/API, but it does not declare a corresponding tool/network scope such as permissions or allowed-tools. This creates a governance gap where the skill can perform outbound network-capable actions without clear least-privilege constraints or transparent authorization boundaries, increasing the risk of unintended data egress or misuse if the script behavior changes or is broader than described.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script sends user-provided travel queries, including destinations, dates, budgets, and preferences, to an external proxy service and attaches a static proxy token, but provides no user-facing disclosure or consent mechanism. In a travel-planning context this can expose personal itinerary and preference data to a third party unexpectedly, creating privacy and compliance risk even if the transport is HTTPS.

Content

No source excerpt is available for this finding.