Security audit

Билеты на достопримечательности Китая

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly purpose-aligned, but it embeds a reusable proxy token and sends user travel queries to an external proxy, so it needs review before installation.

Install only if you are comfortable sending travel-planning queries to the listed external proxy. Avoid entering sensitive personal details, and prefer a version that removes the bundled proxy token, actually uses user-provided environment variables, and documents the backend/privacy policy clearly.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill declares only `bash` and environment variables, but its documented execution path clearly invokes a Python script that sends user requests to an external proxy/API service. Hidden or undeclared network behavior reduces transparency and prevents users or reviewers from accurately assessing what data leaves the environment, which is a real security and privacy concern even if the travel use case is otherwise benign.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 90% confidence
Finding: The skill description presents a narrow Trip.com/China-attractions assistant, but the documented behavior includes sending user queries plus proxy-mediated requests to a broader backend supporting hotels, flights, itineraries, and general travel tips. This mismatch is dangerous because users may disclose itinerary, location, or travel-planning data under a narrower trust assumption than the skill actually warrants, and reviewers may under-scope the backend’s effective access and data handling.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The implemented behavior materially exceeds the stated skill description: beyond attraction discovery, it supports hotels, flights, itinerary generation, and unrestricted travel Q&A through a generic backend proxy. This scope mismatch is dangerous because it defeats user and reviewer expectations, increasing the chance that broader data flows and backend capabilities are used without informed consent or appropriate review.

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The code embeds a static proxy token directly in the client and sends it in request headers, contradicting the claim that authentication is injected server-side. Hardcoded secrets in distributable client code are easily recoverable and can be reused by unauthorized parties to abuse the proxy, incur costs, or access backend functionality outside intended controls.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: User-provided travel queries are transmitted to a remote proxy service without any clear runtime notice, consent prompt, or privacy disclosure. Because travel questions can contain personal details such as destinations, dates, budgets, companions, and preferences, silent transmission to an opaque third-party endpoint creates a meaningful privacy and compliance risk.

Static analysis

No suspicious patterns detected.