Планировщик поездки в Китай

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:53 AM UTC
• Version: 1.0.1

Overview

The skill does what it claims as a China travel planner, but it embeds a reusable proxy authentication token in published code and sends travel details to a third-party proxy.

Review this skill carefully before installing. It appears purpose-aligned, but it exposes a proxy token in source code and routes trip searches, dates, preferences, and questions through a fixed third-party proxy. Avoid entering sensitive personal details, and the publisher should rotate the exposed token and load secrets from a managed environment instead of shipping them in the package.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/china_travel.py:23

Finding

Hard-Coded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/china_travel.py, lines 23–39
Vulnerability Type: Hard-coded authentication credential
Risk Level: High

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query, locale="en", command_type="hotel"):
    """Query via SCF proxy (token injected server-side, affiliate links auto-injected)."""
    payload = {"query": query, "locale": locale, "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL, data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "ChinaTravel/2.0",
        },
        method="POST"
    )

Technical Analysis

A reusable proxy authentication token and its associated service endpoint are embedded directly in distributable source code. Any person able to access the package can recover the token without executing the skill.

The project metadata in SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, but the implementation does not read those variables. It always uses the hard-coded constants. Consequently, external secret injection does not protect or override the exposed credential.

Because the token is sent in the X-Proxy-Token header, an attacker can reproduce the authenticated request independently of this client. Whether the proxy applies additional authorization, strict command validation, or rate limiting cannot be established from the reviewed client code.

Attack Path

1. Obtain or inspect the published skill package.
2. Open scripts/china_travel.py and extract the proxy URL and PROXY_TOKEN value.
3. Construct an HTTPS POST request to the exposed proxy URL.
4. Supply the recovered token in the X-Proxy-Token header a ...[truncated 919 chars]

Remediation

View remediation

Remediation Suggestions

1. Immediately revoke and rotate the exposed proxy token.
2. Remove the token and endpoint from source code and repository history.
3. Load both values from the environment or a managed secret store, consistent with the declarations in SKILL.md:

   python

   import os
   
   PROXY_URL = os.environ.get("PROXY_URL")
   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   
   if not PROXY_URL or not PROXY_TOKEN:
       raise RuntimeError("PROXY_URL and PROXY_TOKEN must be configured securely")
   

4. Do not provide secret-bearing fallback values in source code.
5. Restrict the replacement token to the minimum required API operations and apply short expiration periods where possible.
6. Enforce server-side request validation, per-token rate limits, usage quotas, and abuse monitoring.
7. Store production secrets in the deployment platform’s secret manager and prevent them from appearing in logs or error messages.
8. Add automated secret scanning to development and release pipelines.
9. Review proxy access logs for unauthorized use of the exposed token and invalidate related credentials if suspicious activity is identified.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence

Finding

The skill exposes network-capable behavior through a script and proxy-based API flow, but it does not declare an explicit tool scope such as allowed tools or permissions. This weakens security boundaries and reviewability because the runtime can make outbound requests without a clearly documented least-privilege declaration, increasing the risk of unintended data exfiltration or misuse of environment-provided secrets.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

В инструкции явно сказано всегда добавлять параметр --locale=ru для получения результатов на русском языке. Это фиксирует язык/локаль без механизма выбора или согласия пользователя, что соответствует нарушению языковой/локальной политики.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script sends user-supplied travel queries, including potentially sensitive itinerary details, to a third-party proxy endpoint without any runtime notice, consent, or privacy disclosure. In a travel-planning context, these queries can reveal locations, dates, occupancy, and preferences, creating privacy and data-handling risk if the proxy logs, shares, or misuses the data.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The docstring for query_tripgenie states that affiliate links are automatically injected server-side. In this file, however, the client only sends the query and returns the proxy response; there is no code here that injects or verifies affiliate-link behavior, so the documentation overstates what this code does.

Content

No source excerpt is available for this finding.