T09 · Insecure Skill Coding Practices
Error
- Location
scripts/china_travel.py:23- Finding
Hardcoded Reusable Proxy Credential
- Content
View full analysis
- Remediation
View remediation
Security audit
Бронирование отелей в Китае
Security checks for vulnerabilities and agentic risk
Overview
The skill is a travel booking helper, but it sends user travel details through an under-disclosed proxy, embeds a reusable proxy token, and exposes broader travel modes than its hotel-booking description suggests.
Install only if you are comfortable sending hotel and potentially broader travel details to an undisclosed proxy service. Avoid entering sensitive personal data such as passport numbers, payment details, phone numbers, or exact private plans, and treat returned booking links as untrusted until verified.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
scripts/china_travel.py:23- Finding
Undisclosed Transmission of User Travel Data Through an Opaque Proxy
- Content
View full analysis
1 else ''}") if budget: parts.append(f"budget: {budget}") if preferences: parts.append(f"preferences: {preferences}") ``` ### Technical Analysis The script transmits user-supplied travel information ...[truncated 2050 chars]- Remediation
View remediation
other
Note
- Location
scripts/china_travel.py:192- Finding
Executable Capabilities Exceed the Published Hotel-Booking Scope
- Content
View full analysis
[args...] [--locale=xx] Modes: hotel [check_in] [check_out] [guests] [budget] [preferences] flight [trip_type] [cabin] attraction [days] [interests] itinerary [travelers] [interests] [budget] tips ``` ```python elif mode == "flight": if len(args) < 3: print(json.dumps({"success": False, "error": "flight mode requires: "}, ensure_ascii=False)) sys.exit(1) origin, destination, date = args[0], args[1], args[2] trip_type = args[3] if len(args) > 3 else "one way" cabin = args[4] if len(args) > 4 else "economy" query = build_flight_query(origin, destination, date, trip_type, cabin) result = query_tripgenie(query, locale=locale, command_type="flight") elif mode == "attraction": if len(args) < 1: print(json.dumps({"success": False, "error": "attraction mode requires: "}, ensure_ascii=False)) sys.exit(1) city = args[0] days = args[1] if len(args) > 1 else "1" interests = args[2] if len(args) > 2 else "" query = build_attraction_query(city, days, interests) result = query_tripgenie(query, locale=locale, command_type="attraction") elif mode == "itinerary": if len(args) < 2: print(json.dumps({"success": False, "error": "itinerary mode requires: "}, ensure_ascii=False)) sys.exit(1) city = args[0] days = int(args[1]) travelers = int(args[2]) if len(args) > 2 else 2 interests = args[3] if len(args) > 3 else " ...[truncated 2514 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The documentation says the skill is for hotel search and direct booking via Trip.com, but the described behavior includes additional functions such as flights, attractions, itinerary planning, general travel Q&A, multilingual behavior, and use of a proxy API. This mismatch is dangerous because it obscures the actual operational scope and third-party data flows, preventing informed consent, accurate review, and least-privilege enforcement.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill metadata says it is for hotel search/booking in China, but the script exposes additional capabilities for flights, attractions, itineraries, and generic travel tips. This scope expansion can bypass user and platform expectations, causing users to disclose travel details for functions they did not explicitly authorize and weakening trust and review controls tied to the declared capability.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill invokes a Python script that performs real-time hotel lookups, implying network access, but the manifest does not declare any explicit tool scope or permissions. This creates a transparency and governance gap: reviewers and runtime policy systems cannot easily verify or constrain what external access the skill requires, increasing the risk of unexpected data egress or broader-than-expected external communication.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Mandating
--locale=ruforces Russian-language output regardless of the user's language preference. While not a classic code-execution issue, it can mislead users, degrade comprehension of travel or booking details, and increase the chance of mistakes when users expect another language.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
Stating that all results are always displayed in Russian without offering a language choice creates a user-control and transparency issue. In a travel-booking context, forcing a language can cause misunderstanding of prices, dates, booking terms, or location details, though the impact is primarily usability and trust rather than direct compromise.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
User-provided travel queries, which may contain itinerary dates, destinations, budgets, and preferences, are sent to an external proxy service without any visible disclosure, consent flow, or explanation in the user-facing behavior. The hardcoded remote endpoint and proxy token reinforce that data is leaving the local skill boundary to a third party, creating privacy and compliance risk if users believe processing is local or limited to hotel search.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The cross-feature guidance actively nudges users from hotel search into unrelated functions such as flights, attractions, itineraries, and tips, despite the skill being described as a hotel-focused tool. In context, this increases the practical impact of the scope mismatch by encouraging additional data sharing and use of undeclared features.
- Content