T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/china_travel.py:24- Finding
Hardcoded Proxy Access Token Distributed in Source Code
- Content
View full analysis
- Remediation
View remediation
Security audit
中国ホテル予約
Security checks for vulnerabilities and agentic risk
Overview
The skill performs travel lookups, but it routes user travel details through an under-disclosed proxy and displays unvalidated booking content and links.
Review before installing. Use only if you are comfortable sending destination, dates, guest counts, budget, and preferences to the remote proxy, and treat returned prices and booking links as untrusted until you verify the destination domain yourself. The publisher should disclose the proxy and affiliate behavior, remove or rotate the embedded token, and validate returned links before this is considered low risk.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/china_travel.py:28- Finding
Untrusted Proxy-Controlled Markdown and Booking Links Are Displayed Without Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (8)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The skill is presented as a hotel-search tool, but the behavior indicates broader travel functions, external proxy API use, and affiliate-link injection that are not clearly disclosed. This mismatch is dangerous because it undermines informed consent, broadens the effective attack surface, and can route user queries or booking intent through undisclosed third parties.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The manifest description limits the skill to hotel search with pricing, recommendations, and booking links. However, the module docstring and main dispatch logic expose five modes: hotel, flight, attraction, itinerary, and tips, substantially broadening the skill beyond its declared purpose.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes a Python script that performs real-time hotel lookups via external services, but the manifest does not declare any tool scope or network permission. This creates a transparency and governance gap: reviewers and users cannot accurately assess what external access the skill requires, and hidden network use can enable unintended data transmission.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions explicitly require always passing
--locale=ja, which forces a specific language regardless of the user's preference. This is a natural-language locale policy issue because the skill does not offer a language choice or document a justified region-specific constraint.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The note says all results are displayed in Japanese, which imposes a fixed language without presenting alternatives. The file elsewhere describes the skill for foreign travelers, making the lack of language choice more noticeable.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The inline documentation explicitly states the script supports hotel, flight, attraction, itinerary, and tips modes. That active documentation conflicts with the declared skill intent presented in the manifest, indicating intent-code/documentation divergence.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The code sends user-supplied travel queries and locale to an external proxy service, and includes a hardcoded proxy token in the client request. In this skill context, queries can contain sensitive itinerary details such as destinations, dates, party size, and preferences, so undisclosed transmission to a third party creates a real privacy and credential-exposure risk.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The flight mode accepts arbitrary origin and destination strings and is not restricted to China, while the manifest specifically frames the skill as searching hotels in China. This expands behavior beyond the described geographic and functional scope.
- Content