T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/china_travel.py:22- Finding
Hardcoded Reusable Proxy Credential in Distributed Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
中国観光地チケット
Security checks for vulnerabilities and agentic risk
Overview
This travel skill is purpose-aligned, but it sends travel queries to a fixed external proxy using a hardcoded shared token that users cannot configure or rotate.
Review before installing. Use this only if you are comfortable sending travel questions, dates, locations, budgets, and preferences to the configured proxy and receiving affiliate-linked results. The publisher should remove the embedded shared token, honor environment configuration, document the proxy operator and retention policy, and rotate the exposed credential.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares only a bash tool and omits an explicit tool-scope or permissions policy, yet its documented behavior relies on outbound network access via a proxy and external API. This creates a mismatch between declared and actual capabilities, which can lead to over-privileged execution, poor reviewability, and unexpected data egress if the script behavior changes or is abused.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger keywords are broad enough that ordinary travel-related conversation may invoke the skill unintentionally. Unintended activation can send user queries to the external proxy/API without clear user intent, increasing the chance of unnecessary data disclosure and confusing or manipulative behavior.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The instruction to always force
--locale=jaoverrides user language preference and may cause the skill to process or return content in a language the user did not request. While not a direct code-execution issue, it can undermine user consent and transparency, and in multilingual contexts can result in misleading outputs or unintended transmission of locale-related preferences.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill metadata and header text frame the tool as an attraction-discovery skill, but the implementation also supports hotels, flights, itineraries, and free-form travel tips. This scope mismatch can mislead users and reviewers about what data is collected and what external actions the skill performs, weakening informed consent and security review.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code sends user-supplied travel queries to a remote proxy endpoint, including potentially sensitive itinerary details, without any explicit user-facing disclosure or consent mechanism. In this skill context, users may provide locations, dates, budgets, preferences, and travel plans, so undisclosed transmission to an external service creates a meaningful privacy and data-handling risk.
- Content