중국 여행 플래너

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:58 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent China travel helper, but it sends travel queries to a fixed external proxy using a hardcoded shared token and ignores the documented environment configuration.

Review before installing. This skill will send your travel questions, dates, cities, budgets, and preferences to a fixed third-party proxy and TripGenie service. Avoid entering highly sensitive personal details, and prefer a version that loads proxy configuration from secure environment variables instead of shipping a shared token in source.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/china_travel.py:23

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 23–39
Vulnerability Type: Hardcoded authentication credential
Risk Level: Medium

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

The proxy endpoint and its authentication token are embedded directly in the distributed source code. Any person who can obtain the Skill package can extract the token without needing access to the deployment environment.

SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, but the implementation does not read them. It always uses the shared hardcoded values. Consequently, credential rotation, per-installation isolation, and secure secret injection cannot be performed through the documented configuration.

If the exposed token remains accepted by the proxy, an attacker can reproduce the request independently of the Skill and submit arbitrary supported queries under the shared credential.

Attack Path

1. Download or otherwise obtain the published Skill package.
2. Inspect scripts/china_travel.py and recover PROXY_URL and PROXY_TOKEN.
3. Construct an HTTPS POST request to the exposed proxy endpoint.
4. Set Content-Type: application/json and supply the recovered token in the X-Proxy-Token header.
5. Submit attacker- ...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.

2. Remove the endpoint and token literals from the source code and repository history.

3. Load configuration from the environment as documented, and fail closed when required values are absent:

   python

   import os
   
   PROXY_URL = os.environ.get("PROXY_URL")
   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   
   if not PROXY_URL or not PROXY_TOKEN:
       raise RuntimeError("PROXY_URL and PROXY_TOKEN must be configured securely")
   

4. Store production credentials in a managed secret store rather than source files, package metadata, logs, or command-line arguments.

5. Issue separate, least-privilege credentials per deployment or user instead of distributing one shared token.

6. Prefer short-lived credentials and implement server-side expiration, rotation, revocation, rate limits, request quotas, and abuse monitoring.

7. Restrict the proxy to expected request schemas and command types, and avoid relying on possession of a static client-distributed token as the sole access-control mechanism.

8. Add automated secret scanning to source-control and release pipelines to prevent recurrence.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence

Finding

The skill declares only a local shell tool but the described behavior explicitly sends user queries to an external proxy and downstream TripGenie API, which is effectively network-capable behavior without an explicit tool scope or permission boundary. This weakens security review and user consent because sensitive travel details may be transmitted off-platform despite the manifest not clearly declaring that capability.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The instruction to always include --locale=ko overrides user preference and can cause the skill to send or present results in Korean even when the user did not request that language. While not a classic security flaw, it creates an output-integrity and consent issue because the skill imposes a language transformation that may mislead users or reduce their ability to verify booking details and pricing.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill transmits user-supplied travel queries to an external proxy service, including potentially sensitive itinerary details, without any visible user-facing disclosure or consent mechanism in the code path. In travel context, queries may contain locations, dates, companions, budgets, and preferences, creating privacy risk if users do not realize their data is being sent to a third-party endpoint.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest description says the skill supports attraction tickets, which implies some ticket-oriented lookup or booking capability. In code, attraction mode only builds a natural-language query about top attractions and requests ticket prices and opening hours if available, with no dedicated ticket search or ticket transaction behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 73% confidence

Finding

The manifest advertises travel Q&A support, but the module documentation and CLI expose only a 'tips' mode. While users can submit free-form questions, the code describes and brands this as tips functionality rather than a clear Q&A feature, creating a mild description mismatch.

Content

No source excerpt is available for this finding.