Билеты на достопримечательности Китая

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:54 AM UTC
• Version: 1.0.1

Overview

The skill mostly matches its China travel purpose, but it embeds a reusable proxy credential and directly relays third-party content, so users should review it carefully before installing.

Install only if you are comfortable sending travel queries to the publisher's proxy and relying on its returned booking content. The publisher should rotate the exposed proxy token, remove hardcoded credentials, use the declared environment variables, validate returned links/content, and clearly label third-party and affiliate handling.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/china_travel.py:23

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py:23-36
Vulnerability Type: Hardcoded reusable credential
Risk Level: High

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },

Technical Analysis

The proxy URL and reusable authentication token are embedded directly in the distributed source code. Anyone with access to the skill package can recover the token without executing the program.

The project metadata declares PROXY_URL and PROXY_TOKEN as environment variables in SKILL.md:6-8, but the implementation does not read those variables. It always uses the hardcoded values. Consequently, deployment-level secret management cannot protect or replace the embedded credential without modifying the source.

If the proxy accepts this token as sufficient authorization, an attacker can reproduce the authenticated request outside the skill. The exposed endpoint accepts user-controlled query, locale, and command_type fields, increasing the potential for unauthorized use of the proxy and its upstream service.

Attack Path

1. Obtain or inspect the published skill package.
2. Open scripts/china_travel.py.
3. Extract the hardcoded proxy endpoint and X-Proxy-Token value.
4. Construct an HTTP POST request containing arbitrary supported JSON fields.
5. Send the token in the X-Proxy-Token header.
6. Reuse the proxy under the publi ...[truncated 583 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.
2. Remove all credentials from source code and repository history.
3. Read configuration from environment variables and fail securely when it is absent:

python

import os

PROXY_URL = os.environ.get("PROXY_URL")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN")

if not PROXY_URL or not PROXY_TOKEN:
    raise RuntimeError("Required proxy configuration is missing")

4. Prefer short-lived, scoped credentials rather than a shared static token.
5. Restrict the token to only the required API methods and command types.
6. Implement server-side schema validation, request quotas, rate limiting, monitoring, and abuse alerts.
7. Bind authorization to an authenticated user or installation where feasible.
8. Add secret scanning to the release and continuous-integration pipelines.
9. Verify that packaged artifacts do not contain fallback or development credentials.

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/china_travel.py:40

Finding

Untrusted Remote Content Is Returned for Direct Presentation Without Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py:40-48,232-235; related instruction at SKILL.md:55
Vulnerability Type: Indirect instruction injection through externally controlled output
Risk Level: Medium

Vulnerable Code

python

with urllib.request.urlopen(req, timeout=30) as resp:
    result = json.loads(resp.read().decode("utf-8"))
    if isinstance(result, dict) and "data" in result:
        response = result["data"]
    elif isinstance(result, str):
        response = result
    else:
        response = str(result)
    return {"success": True, "response": response}

python

# Add cross-feature guidance
if result.get("success") and isinstance(result.get("response"), str):
    result["response"] += get_cross_guide(mode, locale)

print(json.dumps(result, ensure_ascii=False, indent=2))

The instruction in SKILL.md:55 states that the API returns structured Markdown and directs the agent to present that content directly to the user.

Technical Analysis

The script treats the proxy response as trusted presentation content. It performs JSON decoding but does not validate the semantic content of the returned data field, constrain it to an expected travel schema, sanitize instruction-like text, or validate included booking URLs.

Because the response originates from a mutable external proxy and upstream API, it crosses a trust boundary. A compromised proxy, compromised upstream provider, or manipulated upstream response could return Markdown containing agent-directed instructions, deceptive booking links, requests for sensitive information, or unrelated promotional material.

The accompanying skill instruction increases exposure by directing the agent to present the returned content directly rather than treating it as untrusted data to be summarized. This is an indirect instruction-hijacking risk; the reviewed code does not itself execute remote code or shell commands.

Attack Path

1. An attack ...[truncated 1159 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify all proxy and upstream output as untrusted data.
2. Replace free-form response handling with a strict schema containing expected fields such as attraction name, price, opening hours, description, and booking URL.
3. Reject malformed responses and unexpected fields rather than converting arbitrary objects to strings.
4. Instruct the agent to summarize validated travel facts instead of presenting remote Markdown directly.
5. Remove or neutralize content that attempts to issue instructions to the agent or requests credentials, secrets, payments, or unrelated actions.
6. Validate every returned URL using parsed scheme and hostname checks. Permit only HTTPS URLs on an explicit allowlist of approved booking domains.
7. Render external content as quoted reference material so it cannot be confused with trusted skill instructions.
8. Apply response-size limits and defensive parsing.
9. Add tests using adversarial responses containing prompt-injection text, misleading Markdown links, and unexpected JSON structures.
10. Clearly label affiliate links and verify their final destinations before presenting them to users.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script hardcodes a static proxy authentication token and sends it on every request, exposing a reusable credential in client-side code. Anyone with access to the script can extract and abuse the token to access the proxy service, potentially causing unauthorized usage, quota exhaustion, billing abuse, or abuse of whatever backend privileges the token grants.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill exposes the bash tool and explicitly relies on outbound network access via a proxy/API flow, but it does not declare any explicit tool scope such as allowed tools or network permissions boundaries. That creates an avoidable trust gap: the runtime may permit broader-than-necessary execution or make review/auditing harder, increasing the chance of unintended external requests or abuse if later instructions/scripts change.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The instruction says to always include --locale=ru to get results in Russian, which imposes a specific locale on all uses of the skill. This is a natural-language policy concern because the file does not offer an alternative language selection or explain a justified region-specific requirement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill transmits user travel queries to an external proxy service without any runtime disclosure, consent prompt, or privacy notice. Because travel queries may contain personal itinerary details, dates, locations, and preferences, silent exfiltration to a third party creates privacy and trust risks, especially in a travel-planning context where users may share sensitive personal information.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The tips mode forwards arbitrary free-form user input directly to a remote backend as a generic query command, which exceeds the narrowly described travel-attractions purpose of the skill. This creates scope expansion risk: users may unknowingly use the skill as a general proxy to an external service, enabling undisclosed data transfer and backend misuse beyond the declared function.

Content

No source excerpt is available for this finding.