Security audit

Бронирование отелей в Китае

Security checks for vulnerabilities and agentic risk

Overview

The skill is travel-related and not destructive, but it sends user travel queries to an under-disclosed remote proxy and contains broader travel modes than its hotel-only listing describes.

Install only if you are comfortable sending hotel and other travel-query details to the skill publisher's remote proxy service. Treat the booking and affiliate-link behavior as publisher-controlled, and avoid entering sensitive personal, payment, passport, or account information through this skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 73% confidence
Finding: The skill invokes a Python script that appears to access remote hotel data, but the skill file does not declare any permissions for network use. Hidden or undeclared network capability reduces transparency and prevents proper policy review, which can mask unexpected data flows or external service usage.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: The documented purpose is narrow hotel search, but the implementation reportedly supports broader travel functions and remote proxy API access with a hardcoded token. This mismatch is dangerous because reviewers and users may authorize the skill under false assumptions while it has materially broader capabilities, including credential-bearing remote access.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill advertises itself in metadata as a hotel-search/bookings capability, but the code and docstring explicitly implement additional modes for flights, attractions, itineraries, and free-form travel tips. This is dangerous because it expands the skill's effective permissions and data handling beyond what users and platform reviewers would reasonably expect, enabling undisclosed functionality and broader routing of user input to a remote backend.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The main request router accepts and processes non-hotel modes, then forwards those queries to the backend, materially broadening behavior beyond the stated hotel-search purpose. In a skill ecosystem, hidden or undeclared routing is risky because users may provide sensitive travel details under false assumptions about feature scope, and operators can silently repurpose the skill for additional data collection or actions.

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The module docstring openly states that the file is an 'All-in-one TripGenie API Client' with five modes, which contradicts the narrower hotel-only description in the skill metadata. While this is partly a transparency issue rather than a direct exploit, such contradictions are a strong signal of scope mismatch and can conceal undeclared functionality from reviewers and users.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: User-provided travel queries are transmitted to a remote proxy endpoint, including itinerary details and other potentially sensitive travel information, without any visible consent flow or disclosure in the skill interface. This creates a privacy and trust risk because users may not realize their inputs are being sent to a third-party service, and the hardcoded proxy architecture increases concern about where data is processed and retained.

Static analysis

No suspicious patterns detected.