Security audit

China Travel Planner

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is purpose-aligned, but it ships a reusable proxy token and forwards travel requests to an external service whose returned booking content is presented directly.

Review this before installing if you are not comfortable sending travel searches, dates, cities, and preferences to the publisher's proxy. Treat booking links and prices as external recommendations, verify destinations before purchasing, and be aware that the published package contains a reusable proxy credential that should be rotated by the publisher.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/china_travel.py:23
Finding: Hard-Coded Reusable Proxy Authentication Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/china_travel.py:42
Finding: Unvalidated Third-Party Content Is Presented as Trusted Skill Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 89% confidence
Finding: The skill declares only the bash tool and no explicit tool scope/permissions, yet its documented behavior depends on outbound network access to a proxy/API. This mismatch weakens least-privilege controls and can let a shell script make broader network requests than users or the platform expect, increasing the risk of data exfiltration or abuse if the script is modified or compromised.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill transmits user-supplied travel queries, dates, cities, and potentially preferences to a third-party proxy service without any user-facing disclosure or consent mechanism. In a travel context, these queries can reveal itinerary details, locations, timing, and personal preferences, creating privacy and data-handling risk if users assume the tool operates locally or do not expect third-party transmission.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring for query_tripgenie states 'affiliate links auto-injected', which describes a monetization or transformation behavior that is not implemented anywhere in this client code. In reality, the function just posts the query to the proxy and returns the response payload, so the inline documentation overstates what the code itself does.
Content: No source excerpt is available for this finding.