China Travel Tips

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:00 AM UTC
• Version: 2.1.2

Overview

This China travel helper is purpose-aligned overall, but it needs Review because it sends user travel details to a remote proxy with a hardcoded reusable token that contradicts the documented token handling.

Install only if you are comfortable with China travel questions, itinerary details, dates, budgets, and preferences being sent to the disclosed remote proxy/TripGenie service. The publisher should remove and rotate the embedded proxy token, make the documented environment variables real, and clearly document retention and affiliate handling before this is treated as low risk.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/china_travel.py:21

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 21–22 and 31–36
Vulnerability Type: Hardcoded reusable credential
Risk Level: Medium

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"

The credential is subsequently included in requests:

python

req = urllib.request.Request(
    PROXY_URL, data=data,
    headers={
        "Content-Type": "application/json",
        "X-Proxy-Token": PROXY_TOKEN,
        "User-Agent": "ChinaTravel/2.0",
    },
    method="POST"
)

Technical Analysis

A reusable proxy authentication token and its corresponding endpoint are distributed in plaintext with the skill. Anyone with access to the package can extract the token without executing the script.

Although SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, the implementation does not read either value from the environment. It always uses the embedded constants. Consequently, deployment-level secret injection cannot protect or replace this credential.

HTTPS protects the token while it is in transit, but it does not protect a credential exposed in source code. The finding does not establish access beyond the proxy authorization granted to this token.

Attack Path

1. An attacker obtains the publicly or otherwise distributable skill package.
2. The attacker opens scripts/china_travel.py and extracts PROXY_URL and PROXY_TOKEN.
3. The attacker constructs direct HTTPS POST requests to the proxy.
4. The attacker supplies the extracted token through the X-Proxy-Token header.
5. If the credential remains active and the server does not impose additional authorization controls, the proxy accepts requests under the exposed credential.
6. The attacker repeatedly submits arbitrary queries within the permissions and limits assigned to that to ...[truncated 726 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.

2. Remove the token from source code and repository history.

3. Load configuration from the environment or an approved secret manager, for example:

   python

   import os
   
   PROXY_URL = os.environ["PROXY_URL"]
   PROXY_TOKEN = os.environ["PROXY_TOKEN"]
   

4. Fail closed with a clear configuration error when either value is absent; do not provide an embedded fallback credential.

5. Use short-lived, narrowly scoped credentials where supported.

6. Apply server-side rate limits, quotas, request validation, and per-client authorization rather than relying solely on a shared static token.

7. Monitor proxy logs for use of the exposed credential and investigate activity occurring before rotation.

8. Add automated secret scanning to development and publication workflows to prevent future credential exposure.

9. Separate credentials by deployment or client so compromise of one package does not expose a shared service-wide identity.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior and the effective behavior do not fully match: the skill presents itself as a travel advice guide, but it forwards user queries to a remote proxy/API and includes affiliate-enabled backend handling. This mismatch is dangerous because users and reviewers may not realize their inputs are being transmitted off-platform for monetized processing, undermining informed consent and security review.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The code comment/docstring claims the token is injected server-side, but the implementation actually embeds and transmits the token from the client. This kind of misleading documentation hides the true trust boundary, increases the chance that reviewers miss the exposed credential, and can cause insecure deployment decisions based on false assumptions.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill declares a bash tool and explicitly describes sending user queries to an external proxy API, but it does not define any explicit tool/network scope restrictions such as allowed-tools or permissions. That creates a transparency and containment problem: a seemingly simple travel helper can make remote requests with user-supplied content, increasing data exposure and making review harder.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The '使用する場面' list and keyword list describe very broad travel-related topics such as general questions, weather, food, language, and safety, but do not define clear boundaries for when the skill should or should not activate. Without explicit trigger phrases, exclusions, or context limits, this description could overlap with ordinary travel conversation and cause unintended invocation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instructions say to 'always' include '--locale=ja' and return results in Japanese, which imposes a fixed language choice regardless of the user's preference. This is a natural-language policy issue because the skill does not offer a language choice or document user opt-in for the locale restriction.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script hardcodes a proxy authentication token and sends it to an external endpoint on every request. This exposes a reusable secret to anyone with access to the skill source and enables unauthorized use of the proxy, quota abuse, impersonation of this client, and potential downstream access to user-submitted travel queries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill forwards user-entered travel questions and itinerary details to a remote proxy service without any explicit disclosure, consent, or local notice in the execution flow. Even if the content seems low sensitivity, travel plans can reveal locations, dates, companions, budgets, and preferences, creating avoidable privacy and data-handling risk when sent to a third party.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The note says all responses are in Japanese and tailored for foreign travelers, but it does not provide any option for other languages. This reinforces a mandatory language policy rather than a documented, user-selectable locale behavior.

Content

No source excerpt is available for this finding.