Бронирование авиабилетов в Китай

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:56 AM UTC
• Version: 1.0.1

Overview

This China travel skill mostly matches its stated purpose, but it needs review because it ships a reusable proxy token and relays external booking content without strong safeguards.

Review before installing. The skill does not show local persistence or destructive behavior, but it sends travel requests to a fixed external proxy and includes a shared proxy token in the package. Users should avoid entering sensitive personal itinerary details, verify booking links independently, and prefer a version that removes the embedded token, documents the external service clearly, and validates returned links and data.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/china_travel.py:24

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 24–38
Vulnerability Type: Hard-coded credential exposure
Risk Level: High

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

A reusable proxy authentication token is embedded directly in the distributed Python source and transmitted in the X-Proxy-Token header. Anyone with access to the Skill package can recover this credential without executing the script.

This also conflicts with the configuration declared by SKILL.md, which lists PROXY_URL and PROXY_TOKEN as environment variables. The implementation does not read either value from the environment. The function documentation states that the token is injected server-side, but the client actually supplies a static token.

Hard-coded credentials cannot be independently protected or rotated without changing and redistributing the package. If the proxy treats this value as an authorization credential, an attacker can reuse it outside the Skill and submit their own requests.

Attack Path

1. An attacker downloads or otherwise obtains the published Skill package.
2. The attacker opens scripts/china_travel.py and extracts the proxy URL and token.
3. The attacker constructs arbitrary HTTPS POST requests to the disclosed proxy ...[truncated 960 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.
2. Remove the token and endpoint configuration from source control and published artifacts.
3. Read configuration from the declared environment variables, failing securely when credentials are unavailable:

   python

   import os
   
   PROXY_URL = os.environ["PROXY_URL"]
   PROXY_TOKEN = os.environ["PROXY_TOKEN"]
   

4. Prefer short-lived, installation-specific credentials rather than one token shared by all users.
5. Store deployment credentials in a managed secret store and inject them only at runtime.
6. Restrict the token to the minimum required API operations and enforce server-side request validation.
7. Add per-client rate limits, quotas, expiration, credential rotation, and abuse monitoring.
8. Review proxy logs for use of the exposed token and investigate anomalous requests.
9. Add automated secret scanning to the publication pipeline to prevent future embedded credentials.

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/china_travel.py:39

Finding

Untrusted Remote API Content Is Forwarded Directly to the Agent

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 39–47 and 230–233; related presentation instruction in SKILL.md, line 59
Vulnerability Type: Remote-content prompt injection and output-trust failure
Risk Level: Medium

Vulnerable Code

python

try:
    with urllib.request.urlopen(req, timeout=30) as resp:
        result = json.loads(resp.read().decode("utf-8"))
        if isinstance(result, dict) and "data" in result:
            response = result["data"]
        elif isinstance(result, str):
            response = result
        else:
            response = str(result)
        return {"success": True, "response": response}

python

# Add cross-feature guidance
if result.get("success") and isinstance(result.get("response"), str):
    result["response"] += get_cross_guide(mode, locale)

print(json.dumps(result, ensure_ascii=False, indent=2))

The related Skill instruction tells the agent to present the returned API content directly to the user.

Technical Analysis

The script accepts the remote proxy's data field as an unrestricted string and returns it without schema validation, content separation, link validation, or a warning that the value is untrusted external content. The Skill instructions then direct the agent to present that content directly.

Although the Python script does not itself execute the response, an agent consuming the result may interpret embedded imperative text as instructions rather than travel data. A malicious or compromised proxy, upstream API, or content source could therefore insert prompt-injection text, deceptive booking information, or links to attacker-controlled domains.

Appending trusted cross-feature guidance to the same string does not create a security boundary. Trusted Skill-generated text and untrusted remote content remain combined in one response field, making their provenance difficult for the receiving agen ...[truncated 1610 chars]

Remediation

View remediation

Remediation Suggestions

1. Explicitly classify every proxy response as untrusted external data.
2. Replace the instruction to present content directly with guidance that remote content must never override system, developer, user, or Skill instructions.
3. Require and validate a strict response schema containing separate fields for flights, hotels, prices, schedules, and links rather than accepting arbitrary Markdown.
4. Reject unexpected object types, fields, oversized responses, and malformed values instead of converting them to unrestricted strings.
5. Validate booking URLs against an explicit HTTPS hostname allowlist, such as the intended Trip.com domains, and reject redirects to unapproved domains.
6. Keep trusted Skill guidance and untrusted API data in separate structured fields with clear provenance labels.
7. Render external text as quoted data and instruct the consuming agent not to execute commands, invoke tools, disclose secrets, or follow behavioral instructions found in that text.
8. Apply response-size limits and appropriate output encoding.
9. Add tests containing common indirect prompt-injection payloads and confirm that they are displayed only as untrusted content.
10. Where feasible, have the proxy return normalized records generated from validated upstream data rather than arbitrary natural-language output.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (6)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill declares access to the bash tool and instructs execution of a Python script that sends user requests to an external proxy/API, but it does not define an explicit tool/network scope such as permissions or allowed-tools. This creates an authorization ambiguity: a caller may not realize the skill performs outbound network activity and handles proxy-backed requests, increasing the risk of unintended data egress or overbroad execution privileges.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The 'Когда использовать' section and keyword list describe broad travel-related requests but do not clearly define the activation boundary for this skill versus general travel assistance. Because the file also advertises hotels, attractions, itineraries, and travel tips, the trigger scope is ambiguous and lacks exclusion examples or explicit constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill instructs the agent to always force --locale=ru, regardless of the user's language preference. While not a direct code-execution issue, forcing output language without consent can mislead users, reduce their ability to verify booking details, and increase the chance of mistakes when reviewing prices, dates, or reservation terms.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description centers on searching flights to China and domestic flights with real-time prices, schedules, and booking links, while only secondarily mentioning support for hotels, attractions, trip planning, and travel tips. This file is an all-in-one client whose documented modes and implementation substantially cover hotel search, attractions, itinerary generation, and generic travel Q&A, making the actual behavior materially broader than a flight-search-focused skill description.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The docstring claims server-side token injection, but the client code embeds and transmits a proxy token in the request header. Hardcoding a credential in distributed client-side code exposes it to extraction and reuse by anyone who can inspect the skill, enabling unauthorized use of the proxy and reducing the trustworthiness of the stated security model.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user-provided travel queries and locale to a third-party proxy service without any visible disclosure, consent flow, or minimization. Travel queries can contain sensitive itinerary details, destinations, dates, and preferences, so silent transmission to a remote endpoint creates privacy and data-handling risk, especially because the proxy is not clearly identified to the user.

Content

No source excerpt is available for this finding.