tripadvisor-api

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:08 PM UTC
• Version: 0.6.2

Overview

The skill is mostly read-only TripAdvisor lookup guidance, but it handles secrets and browser-backed content in ways users should review before installing.

Review this skill before installing. Avoid running the .env grep command in an agent transcript or shared terminal; set TRIPADVISOR_API_KEY through a secure environment or secret manager instead. If you use the fallback, pin and review the fpx CLI version, understand that it uses your signed-in browser session for TripAdvisor fetches, and replace the fixed /tmp file with a secure temporary file that is deleted after parsing.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:30
• Finding: API Key Disclosure Through Terminal Output<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 30–33 **Vulnerability Type**: Credential exposure through plaintext terminal output **Risk Level**: High ### Vulnerable Code ```sh # Prefer the env var tripadvisor-mcp itself reads (check its .env first): grep -h TRIPADVISOR_API_KEY ~/git/tripadvisor-mcp/.env 2>/dev/null export TRIPADVISOR_API_KEY='...' ``` ### Technical Analysis The documented setup command reads `TRIPADVISOR_API_KEY` from another project's `.env` file and writes the complete matching line to standard output. Accessing an existing key may support the declared API-query functionality, but printing its value is unnecessary and exceeds minimum disclosure requirements. Terminal output may be retained in agent transcripts, command logs, CI logs, terminal scrollback, screen recordings, or support diagnostics. The fixed path also causes the Skill to inspect a credential-bearing file outside its own project directory without first obtaining explicit confirmation from the user. Redirecting errors to `/dev/null` does not protect the key because successful output remains visible. The command may also print duplicate definitions or additional text appearing on any line containing the variable name. ### Attack Path 1. A user or agent follows the documented one-time setup instructions. 2. The `grep` command reads `~/git/tripadvisor-mcp/.env`. 3. The matching line, including the plaintext API key, is printed to standard output. 4. The output is captured in an agent transcript, terminal log, CI output, screen share, or another observable channel. 5. A party with access to that channel extracts the key. 6. The exposed key is used to make requests against the TripAdvisor Terra API until it is revoked or its quota is exhausted. ### Impact Assessment An attacker obtaining the key can exercise the Terra API permissions associated with that credential. Based on the audited documentation, the API operations are read-only, so this does n ...[truncated 368 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not print or otherwise return the API key through agent-visible output. - Ask the user to configure the environment variable independently through an approved secret manager or shell configuration. - If loading the existing `.env` file is required, obtain explicit user approval and import it without displaying its contents: ```sh if [ -f "$HOME/git/tripadvisor-mcp/.env" ]; then set -a . "$HOME/git/tripadvisor-mcp/.env" set +a fi test -n "${TRIPADVISOR_API_KEY:-}" || printf '%s\n' 'TRIPADVISOR_API_KEY is not configured.' >&2 ``` - Before sourcing a file, verify that it is a regular file owned by the current user and is not writable by other users. - Prefer a dedicated secret manager over sourcing arbitrary `.env` content. - Never echo the variable, include it in generated reports, or enable shell tracing while it is being loaded. - Revoke and rotate any key that has already appeared in retained logs or transcripts. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:101
• Finding: Unpinned Global Installation of a Third-Party CLI Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 101 **Vulnerability Type**: Unsafe dependency installation and supply-chain exposure **Risk Level**: Medium ### Vulnerable Code ```sh npm install -g @fetchproxy/cli # provides `fpx` ``` ### Technical Analysis The setup instructions install the current registry-selected release of `@fetchproxy/cli` globally. No package version, lockfile, artifact digest, or integrity value is specified. Consequently, the code executed by this instruction can change after the Skill has been reviewed. npm installation may run package lifecycle scripts under the privileges of the invoking user. A compromised maintainer account, malicious package release, registry compromise, or unexpected upstream change could therefore introduce code execution during installation. Global installation also increases the package's effect on the user's environment and may require elevated privileges on some systems. The audit did not establish that `@fetchproxy/cli` is malicious. The vulnerability is the mutable, globally installed dependency and the lack of controls needed to verify the exact code being installed. ### Attack Path 1. An attacker compromises the package publisher, an authorized maintainer account, or the relevant package-distribution path. 2. The attacker publishes a malicious release under the existing package name. 3. A user follows the Skill instructions after that release becomes the version selected by npm. 4. `npm install -g` retrieves the changed package without a reviewed version or integrity constraint. 5. Malicious lifecycle code executes with the permissions of the user running npm. 6. The installed global executable can continue to run attacker-controlled behavior whenever the documented `fpx` commands are invoked. ### Impact Assessment Successful exploitation can execute arbitrary code with the privileges of the account performing the installation. This may permit access t ...[truncated 400 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the CLI to a specifically reviewed version rather than installing the mutable latest release: ```sh npm install --save-exact @fetchproxy/cli@<reviewed-version> ``` - Prefer a project-local dependency controlled by a committed lockfile instead of a global installation. - Verify the package publisher, provenance, signatures, and registry source before installation. - Record and validate the expected package integrity digest. - Avoid `sudo npm install -g` and do not request elevated privileges. - Where compatible, disable lifecycle scripts during installation: ```sh npm install --ignore-scripts --save-exact @fetchproxy/cli@<reviewed-version> ``` - If lifecycle scripts are required, review their exact pinned contents before enabling them. - Document the reviewed version and establish an explicit process for testing and approving upgrades. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: references/web-fallback.md:27
• Finding: Predictable Temporary File Enables Symlink Overwrite and Data Retention<![CDATA[ ## Vulnerability Details **File Location**: `references/web-fallback.md`, lines 27–32 **Vulnerability Type**: Unsafe temporary-file creation **Risk Level**: Medium ### Vulnerable Code ```sh LOCATION_ID=104675 fpx get "https://www.tripadvisor.com/Attraction_Review-g1-d${LOCATION_ID}-Reviews-a-a.html" \ -p tripadvisor > /tmp/ta-location.html # The page embeds 3 application/ld+json blocks; the business node is the # one with BOTH `name` and `aggregateRating` (its @type varies by category: ``` The subsequent parser reads the same predictable path: ```python html = open(sys.argv[1]).read() ``` ### Technical Analysis The recipe writes fetched browser content to the fixed path `/tmp/ta-location.html` using ordinary shell redirection. Shared temporary directories are generally writable by multiple local users. The redirection does not request exclusive creation, verify that the destination is a regular file, or protect against symbolic links. If platform-level temporary-file protections do not block the operation, an attacker can pre-create that path as a symbolic link to another file writable by the victim. Shell redirection then opens and truncates the linked target before `fpx` writes the response. A pre-existing regular file can also be overwritten. Concurrent executions share the same file, creating race conditions and allowing one invocation to parse another invocation's content. The recipe also does not delete the downloaded HTML, leaving browser-fetched data on disk after completion. ### Attack Path 1. A local attacker predicts the documented path `/tmp/ta-location.html`. 2. Before the victim runs the recipe, the attacker creates that path as a symbolic link to a file the victim can write, or prepares it to interfere with concurrent access. 3. The victim executes the documented `fpx get ... > /tmp/ta-location.html` command. 4. Shell redirection follows the link where permitted and truncates the linked target, or overwrites attacker-control ...[truncated 797 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Create a unique temporary file securely, restrict its permissions, and ensure cleanup on every exit path: ```sh tmp=$(mktemp "${TMPDIR:-/tmp}/ta-location.XXXXXX") || exit 1 chmod 600 "$tmp" trap 'rm -f -- "$tmp"' EXIT HUP INT TERM LOCATION_ID=104675 url="https://www.tripadvisor.com/Attraction_Review-g1-d${LOCATION_ID}-Reviews-a-a.html" fpx get "$url" -p tripadvisor >"$tmp" && python3 - "$tmp" <<'PY' import json import re import sys with open(sys.argv[1], encoding="utf-8") as stream: html = stream.read() for match in re.findall( r'<script[^>]*type=["\']application/ld\+json["\'][^>]*>(.*?)</script>', html, re.S | re.I, ): try: obj = json.loads(match.strip()) except Exception: continue if isinstance(obj, dict) and "name" in obj and "aggregateRating" in obj: print(json.dumps(obj)) break PY ``` Additional hardening measures: - Do not use a fixed filename in a shared temporary directory. - Ensure the temporary file is created atomically rather than checking a path before creating it. - Use a restrictive `umask`, such as `umask 077`, before creating sensitive temporary artifacts. - Validate that the fetched response has the expected content type and structure before parsing. - Remove the temporary file through a trap even when fetching or parsing fails. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Credential Access

High

• Category: Privilege Escalation

Content

## One-time setup: get a Terra key

```sh
# Prefer the env var tripadvisor-mcp itself reads (check its .env first):
grep -h TRIPADVISOR_API_KEY ~/git/tripadvisor-mcp/.env 2>/dev/null
export TRIPADVISOR_API_KEY='...'
```

• Confidence: 93% confidence
• Finding: This line directs credential access by reading a local .env file for TRIPADVISOR_API_KEY. In a skill context, instructions to inspect local secret files are high-risk because they can induce an agent or user to exfiltrate credentials from unrelated local development resources, exceeding the least-privilege scope needed to perform the advertised read-only API queries.

Credential Access

High

• Category: Privilege Escalation

Content

```sh
# Prefer the env var tripadvisor-mcp itself reads (check its .env first):
grep -h TRIPADVISOR_API_KEY ~/git/tripadvisor-mcp/.env 2>/dev/null
export TRIPADVISOR_API_KEY='...'
```

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Ae1

High

• Category: analysis-evasion

Content

`references/terra-endpoints.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

`references/terra-endpoints.md`.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger text includes "any TripAdvisor data request that should hit the API directly," which is open-ended and lacks clear boundaries or exclusion conditions. This makes activation scope ambiguous because many ordinary TripAdvisor-related requests could match without specifying when this skill should not be used.

Context-Inappropriate Capability

Low

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the user to read a credential from a local checkout's .env file, which expands its behavior from TripAdvisor querying into local secret discovery. Even though it targets a specific key, teaching an agent or user to inspect local secret files increases the chance of unauthorized credential exposure, accidental logging, or reuse outside the intended system boundary.

Missing User Warnings

Low

• Confidence: 86% confidence
• Finding: The skill exposes a concrete credential retrieval command without any warning that the .env file contains sensitive secrets and should not be echoed, logged, or reused broadly. This normalizes unsafe secret-handling practices and can lead to accidental disclosure in shell history, transcripts, or agent output.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: This markdown file instructs users to send requests with `X-API-Key: $TRIPADVISOR_API_KEY`, which involves use of a sensitive credential. While the examples are read-only, the document does not include any warning about protecting the key, avoiding shell history leakage, or ensuring the credential is set appropriately.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The documented fallback fetch saves browser-authenticated TripAdvisor page content into a predictable world-accessible temporary path (`/tmp/ta-location.html`) without warning about local persistence or access controls. On multi-user systems or shared environments, this can expose browsing-derived content, session-adjacent artifacts, or location data to other local processes/users and leaves recoverable data on disk longer than necessary.

Static analysis

No suspicious patterns detected.