T09 · Insecure Skill Coding Practices
Error
- Location
scripts/china_travel.py:23- Finding
Hardcoded Proxy Authentication Token
- Content
View full analysis
- Remediation
View remediation
Security audit
중국 호텔 예약
Security checks for vulnerabilities and agentic risk
Overview
This hotel skill sends travel details to an under-disclosed cloud proxy and includes broader travel features than advertised, so users should review it before installing.
Install only if you are comfortable sending travel searches, dates, budgets, preferences, and free-form questions to an unidentified cloud proxy in addition to any downstream travel service. Avoid entering passport, payment, account, or highly sensitive itinerary details, and treat returned booking links as unverified unless you independently confirm the destination.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
scripts/china_travel.py:22- Finding
User Travel Data Is Transmitted Through an Undisclosed Cloud Proxy
- Content
View full analysis
1 else ''}") if budget: parts.append(f"budget: {budget}") if preferences: parts.append(f"preferences: {preferences}") parts.append("Include hotel names, prices per night, ratings, key features.") return ", ".join(parts) ``` ### Technical Analysis The script sends user-derived travel information to a project-s ...[truncated 1736 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/china_travel.py:40- Finding
Untrusted Remote Markdown Is Presented Without Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documented behavior says the skill is for hotel search and direct Trip.com booking, but the actual capability set appears broader, including flights, attractions, itinerary generation, general travel Q&A, and use of an external TripGenie proxy rather than the claimed direct destination. This mismatch undermines informed consent and trust boundaries, and can lead to unexpected data disclosure to third-party services or use of features the user did not intend to invoke.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata describes a China hotel search/booking tool, but the code exposes materially broader capabilities including flights, attractions, itineraries, and general travel queries. This scope mismatch is dangerous because it defeats user and platform expectations, enabling undisclosed data handling and functionality expansion through a skill that appears narrower and safer than it is.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The code implements flight search, attraction discovery, and itinerary planning, all of which exceed the manifest's stated hotel-focused scope. This is dangerous because hidden or undeclared features can bypass review assumptions, expand data collection, and make users invoke capabilities they were never informed the skill contained.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 90% confidence
- Finding
The skill appears to invoke a network-capable script but does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: reviewers and users cannot reliably tell what external access the skill requires, and the runtime may permit broader data egress than intended.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The instructions explicitly require always passing
--locale=koand the document states that all results are shown in Korean. This is a natural-language locale policy constraint without user opt-in or an offered language choice, which matches the policy-violation category.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The generic 'tips' mode allows arbitrary travel Q&A beyond hotel search, which is outside the declared purpose of the skill. Even if the content appears harmless, this creates an undeclared general-purpose remote query channel and broadens what user input may be collected and transmitted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User queries and locale are sent to an external proxy endpoint, and the skill gives no user-facing notice that their travel requests are transmitted to a remote third party. In this context, free-form travel questions may contain personal itinerary details, dates, destinations, and preferences, so undisclosed exfiltration to a remote service creates a meaningful privacy and trust risk.
- Content