Security audit

Бронирование авиабилетов в Китай

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed China travel lookup skill that sends travel queries to a proxy-backed TripGenie service and returns booking links, without local persistence or account-changing behavior.

Install only if you are comfortable sending travel queries, dates, routes, hotel preferences, and advice questions to the publisher's proxy and upstream travel services. Do not enter passport numbers, payment details, account credentials, or other sensitive personal information, and review any Trip.com booking terms yourself before purchasing.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 93% confidence
Finding: The skill declares only the bash tool, but its documented behavior explicitly sends user queries to an external proxy and TripGenie/Trip.com services, which is effectively network-capable behavior without transparent permission declaration. This can undermine user consent and platform security expectations because travel queries, dates, and locations are transmitted off-platform despite the manifest not clearly surfacing network access as a permission-sensitive capability.

Description-Behavior Mismatch

Medium

Confidence: 81% confidence
Finding: The 'tips' mode forwards arbitrary free-form user input to a remote backend, expanding the skill from structured travel lookup into a general proxy for unbounded external queries. This increases data exfiltration and policy-bypass risk because users may submit sensitive text or non-travel prompts that are transmitted off-platform without meaningful restriction.

Natural-Language Policy Violations

Medium

Confidence: 84% confidence
Finding: Forcing `--locale=ru` for all requests without checking the user's language preference can cause unintended disclosure or misrepresentation of booking content, including fare rules or conditions in a language the user may not understand. In a travel-booking context, this increases the risk of user confusion, mistaken purchases, or failure to review important terms accurately.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: User travel queries are sent to an external proxy service, along with a hardcoded proxy token, but the skill provides no user-facing disclosure or consent flow about this transmission. In this context, queries may contain personal itinerary details, travel dates, locations, and preferences, so silent transmission to a third party creates a meaningful privacy and data-handling risk.

Static analysis

No suspicious patterns detected.