China Flight Booking

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:03 AM UTC
• Version: 2.1.1

Overview

The skill is a coherent China travel search helper, but it needs review because it sends travel queries through an external proxy, embeds a proxy token in source code, and presents remote Markdown directly.

Install only if you are comfortable sending travel searches, dates, preferences, budgets, and free-form questions to the listed external proxy and receiving booking links generated by that service. Treat returned links and Markdown as external content, and the publisher should rotate the exposed proxy token, move it to secure configuration, and validate or template API responses before direct presentation.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/china_travel.py:22

Finding

Hardcoded Proxy Authentication Token in Source Code

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 22-36
Vulnerability Type: Hardcoded authentication credential
Risk Level: Medium

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

The proxy authentication token is embedded directly in distributable source code. Any party able to download or inspect the Skill can recover and reuse this credential independently of the intended script.

This implementation also conflicts with SKILL.md, which declares PROXY_TOKEN and PROXY_URL as environment-provided configuration. Embedding a shared credential prevents secure per-deployment configuration and requires a source release to rotate it. HTTPS protects the token in transit but does not protect it from source-code disclosure.

Attack Path

1. An attacker downloads or otherwise obtains the published Skill package.
2. The attacker reads scripts/china_travel.py and extracts the proxy URL and X-Proxy-Token value.
3. The attacker constructs direct HTTPS POST requests to the proxy using the recovered header.
4. If the server accepts the shared token without further authorization controls, the attacker submits unauthorized queries outside the Skill.
5. The attacker can continue using the credential until it is revoked or rotated.

Impact Assessment

...[truncated 535 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed token.
2. Remove PROXY_TOKEN from source code and retrieve it from the environment, a platform secret store, or another protected runtime credential provider.
3. Fail closed when the required secret is absent rather than falling back to a bundled credential.
4. Configure separate, narrowly scoped credentials for different deployments or users where practical.
5. Apply server-side rate limiting, usage quotas, request validation, and monitoring because client-side secrecy cannot be guaranteed for distributed Skills.
6. Restrict the token to only the required proxy operation and upstream API capabilities.
7. Review source history and previously published package versions for the exposed value.
8. Add secret scanning to the publication workflow.

A safer configuration pattern is:

python

import os

PROXY_URL = os.environ["PROXY_URL"]
PROXY_TOKEN = os.environ["PROXY_TOKEN"]

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/china_travel.py:40

Finding

Untrusted Remote Content Is Forwarded Directly into Agent-Facing Output

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 40-48 and 233-236; SKILL.md, lines 52-54
Vulnerability Type: Indirect instruction injection through an external API response
Risk Level: Medium

The response-processing code accepts arbitrary remote text:

python

        with urllib.request.urlopen(req, timeout=30) as resp:
            result = json.loads(resp.read().decode("utf-8"))
            if isinstance(result, dict) and "data" in result:
                response = result["data"]
            elif isinstance(result, str):
                response = result
            else:
                response = str(result)
            return {"success": True, "response": response}

It then emits that text without schema validation or safe rendering:

python

    # Add cross-feature guidance
    if result.get("success") and isinstance(result.get("response"), str):
        result["response"] += get_cross_guide(mode, locale)

    print(json.dumps(result, ensure_ascii=False, indent=2))

The Skill instructions explicitly direct the agent to present the remote content:

markdown

### Step 3: Present results

The API returns structured Markdown with airline names, flight numbers, departure/arrival times, prices, and direct booking links. Present the content directly to the user.

Technical Analysis

The proxy and its upstream service are treated as trusted producers of arbitrary Markdown rather than as untrusted data sources. The code only checks whether the top-level response is a dictionary or string; it does not enforce a schema for flight, hotel, attraction, or itinerary fields.

Consequently, a compromised, malicious, or incorrectly configured upstream service could place prompt-like instructions, deceptive claims, or unsafe links in the returned data field. The accompanying Skill instruction tells the agent to present this material directly, weakening ...[truncated 1665 chars]

Remediation

View remediation

Remediation Suggestions

1. Treat all proxy and upstream responses as untrusted data rather than agent instructions.
2. Require a strict JSON schema for each command type, including defined fields and data types for names, schedules, prices, ratings, and URLs.
3. Reject unexpected free-form fields and responses that do not satisfy the relevant schema.
4. Render validated fields through local templates instead of forwarding arbitrary remote Markdown.
5. Validate booking URLs against an explicit HTTPS hostname allowlist and reject redirects or alternate schemes where possible.
6. Update SKILL.md to tell the agent that external results may contain untrusted text and must never override system, developer, user, or Skill instructions.
7. Prevent the agent from following operational instructions embedded in API data.
8. Separate factual result fields from explanatory text and label all remote prose clearly as external content.
9. Add tests containing prompt-injection strings, malformed JSON, unexpected nested objects, deceptive Markdown links, and oversized responses.
10. Apply response-size limits and logging suitable for detecting anomalous upstream content without recording sensitive user queries.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill declares the bash tool and instructs running a Python script that makes outbound requests via a proxy, but it does not define any explicit tool scope such as permissions or allowed-tools. That weakens least-privilege controls and can allow broader command execution or network use than intended if the skill or supporting script is modified or abused.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill transmits user-supplied travel data, including destinations, dates, budgets, preferences, and free-form questions, to a third-party proxy endpoint without any visible disclosure or consent mechanism. In a travel context this can expose sensitive personal or behavioral information to an external operator, increasing privacy, profiling, and retention risks, especially because the proxy is not obviously the primary service the user expects.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The cross-feature guidance shown to users says they can 'book flights' in attraction/itinerary/tips contexts. However, the implementation only builds natural-language queries and POSTs them to a proxy, with no booking action, checkout flow, or reservation API invocation present in the code.

Content

No source excerpt is available for this finding.