中国航空券予約

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:04 AM UTC
• Version: 1.0.2

Overview

This travel-search skill does what it claims, but it ships a reusable proxy token in source code and sends travel queries to a remote service, so it needs review before installation.

Install only if you are comfortable sending travel search details to the listed remote proxy and TripGenie. The publisher should remove and rotate the embedded proxy token, honor the documented environment configuration, and make locale and external-request behavior clearer before broad use.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/china_travel.py:22

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 22–38
Vulnerability Type: Hardcoded reusable authentication credential
Risk Level: Medium

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

The source code embeds a reusable proxy authentication token and sends it in the X-Proxy-Token request header. Any party that can download or inspect the skill package can extract this credential without executing the skill.

This also conflicts with SKILL.md, which declares PROXY_URL and PROXY_TOKEN as environment-based configuration. The implementation never reads those environment variables and instead always uses the embedded values. Consequently, secret distribution, per-installation configuration, revocation, and rotation cannot be managed securely through the declared configuration mechanism.

The hardcoded URL is not independently a secret, but it gives an attacker the exact endpoint against which the exposed token can be tested and reused.

Attack Path

1. Obtain a copy of the published skill package.
2. Inspect scripts/china_travel.py.
3. Extract the fixed proxy endpoint and the value assigned to PROXY_TOKEN.
4. Construct HTTP POST requests to the endpoint using the exposed value in the X-Proxy-Token header.
5. Sub ...[truncated 927 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed token, treating it as compromised.
2. Remove the token from source code and repository history.
3. Load the endpoint and credential from the declared environment variables or a managed secret store:

   python

   import os
   
   PROXY_URL = os.environ.get("PROXY_URL")
   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   
   if not PROXY_URL or not PROXY_TOKEN:
       raise RuntimeError("PROXY_URL and PROXY_TOKEN must be configured securely")
   

4. Avoid distributing a shared long-lived credential to clients. Prefer short-lived, per-installation, or per-user tokens with narrowly scoped permissions.
5. Enforce server-side authentication, authorization, rate limits, request-size limits, quotas, abuse monitoring, and rapid revocation.
6. Redact credentials from logs and error reports, and prevent them from being included in future package artifacts.
7. Add automated secret scanning to source-control and release pipelines.
8. Document what user query data is transmitted to the proxy and ensure the remote service applies appropriate retention, logging, and privacy controls.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill declares the bash tool and explicitly instructs execution of a Python script that sends user queries to an external proxy/API, but it does not define any tool scope restrictions such as allowed tools or network permissions. This creates an under-scoped execution model where network-capable behavior exists without explicit policy boundaries, increasing the chance of unintended external data transmission or misuse.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The trigger keyword list is broad and overlaps with common travel-related conversation, so the skill may activate on routine queries the user did not intend to route through this external-booking workflow. Because activation leads to external network requests and affiliate link generation, accidental invocation can expose user travel intent or parameters to third parties without clear user intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction to always force --locale=ja overrides the user's language preference and can cause results to be presented in an unexpected language. While not a direct code-execution issue, it can mislead users, reduce transparency, and increase the risk of misunderstanding pricing, schedules, or booking details in a transactional context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends user-supplied travel data, including locations, dates, guest counts, preferences, and free-form questions, to a remote third-party proxy service without any visible disclosure or consent mechanism. This creates a privacy risk because sensitive itinerary and preference data may be collected, retained, or correlated by the remote service, and the skill context involves personal travel details that users may reasonably expect to stay within the assistant ecosystem.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The code hardcodes a proxy credential and transmits it in the client request header, directly contradicting the comment that the token is injected server-side. Any user with access to the skill source can extract and reuse this token to call the backend proxy, which can lead to unauthorized use, quota abuse, or use of the service outside intended controls.

Content

No source excerpt is available for this finding.