China Travel Tips

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:05 AM UTC
• Version: 2.1.1

Overview

The skill provides China travel help, but it ships a reusable proxy token in its source code and misstates how that token is handled.

Use this skill only if you are comfortable sending travel questions and itinerary details to its external proxy service. The main issue is not local system takeover; it is that the published package exposes a proxy credential and inaccurately describes how authentication is handled, so the publisher should rotate the token and move authentication out of client source before broad installation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/china_travel.py:23

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 23–24 and 31–39
Vulnerability Type: Hardcoded authentication secret
Risk Level: High

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

A proxy authentication token is embedded directly in distributed source code and sent in the X-Proxy-Token request header. Anyone who can obtain the skill package can recover this credential without executing the program.

The issue is compounded by an implementation mismatch: SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, but the script does not read those variables and always uses the hardcoded values. Consequently, secret rotation through deployment configuration is ineffective unless the source itself is changed.

The token's precise server-side permissions cannot be established from the repository. Nevertheless, it appears sufficient to authenticate requests to the fixed Tencent SCF proxy, making unauthorized replay feasible.

Attack Path

1. Obtain or download the published skill package.
2. Inspect scripts/china_travel.py.
3. Extract the hardcoded proxy URL and PROXY_TOKEN.
4. Construct HTTPS POST requests to the proxy using the recovered value in the X-Proxy-Token header.
5. Submit arbitrary suppo ...[truncated 740 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.
2. Remove the token from source code and repository history.
3. Load the endpoint and credential from deployment-managed environment variables or a secret manager:

   python

   import os
   
   PROXY_URL = os.environ["PROXY_URL"]
   PROXY_TOKEN = os.environ["PROXY_TOKEN"]
   

4. Fail safely at startup when required configuration is absent; do not add an embedded fallback secret.
5. Use short-lived, narrowly scoped credentials rather than one static token shared by every installation.
6. Enforce server-side authorization by permitted operation, along with rate limits, quotas, replay protections, monitoring, and rapid revocation.
7. Avoid distributing reusable upstream credentials to client-side skill packages. Where feasible, authenticate individual installations or users through a controlled credential-exchange mechanism.
8. Add automated secret scanning to version control and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares access to the bash tool and describes outbound calls to a proxy/API, but it does not constrain tool/network scope with an explicit permission model. That creates an over-privileged execution surface where the script could make unintended external requests or use environment-provided secrets beyond what users would reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

A proxy token is embedded in the client and transmitted on requests without disclosure, creating both a secret-management issue and an opaque data flow to a third party. Anyone who can read the file can reuse the token to access the proxy, potentially consuming quota, impersonating the client, or probing backend behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-supplied travel queries, which may contain personal trip details such as locations, dates, budgets, and preferences, to an external proxy service without any user-facing notice or consent flow. In a travel assistant context this is more sensitive than generic search because itineraries can reveal behavioral patterns and future whereabouts.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code comment claims the proxy token is injected server-side, but the client hardcodes and sends the token in every request. This exposes a reusable credential to anyone with access to the skill source or runtime and misleads reviewers about where trust boundaries actually are.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says the API returns answers in English and instructs the agent to present them directly, which imposes a default language choice in natural-language behavior. Although localized results are optionally supported elsewhere, this line presents English as the required output without first checking user preference.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This line explicitly mandates that all answers are in English, which is a natural-language locale restriction. Because the file does not frame this as user-selectable behavior at this point, it violates the requirement to avoid forcing a specific language without opt-in.

Content

No source excerpt is available for this finding.