T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/china_travel.py:24- Finding
Hardcoded Proxy Authentication Token in Distributed Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
China Hotel Booking
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent China travel lookup tool, but it embeds a proxy credential and relays remote booking content too directly for users to install without review.
Review this before installing if you may enter sensitive travel details or follow booking links. The skill sends queries to an external proxy and includes a shared proxy token in its source; treat returned prices, recommendations, and links as untrusted until verified independently.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:59- Finding
Untrusted Remote Markdown Is Relayed Directly to the Agent and User
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill declares access to the bash tool and explicitly instructs execution of a Python script that sends user queries to an external proxy/API, but it does not define any tool scope restrictions such as allowed-tools or permissions. This creates an avoidable trust gap: the agent may have broader execution or network capability than the skill contract makes explicit, increasing the risk of unintended outbound requests or misuse if the script or surrounding environment is modified.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill transmits user-provided travel queries, dates, budgets, preferences, and itinerary questions to a third-party proxy service without any explicit disclosure or consent mechanism. Even if this is expected for functionality, these inputs can contain sensitive personal or behavioral data, creating privacy and compliance risk if users are unaware of the external data transfer.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The docstring describes a specific behavior—server-side token injection and automatic affiliate-link injection—but the code actually includes a hardcoded proxy token in the outbound request header. This is not just omitted detail: the documentation implies a different trust boundary and request behavior than the implementation uses.
- Content