schedule-planner-cxf

• Outcome: Review
• Latest audit: Jul 15, 2026 · 2:38 AM UTC
• Version: 1.0.12

Overview

The skill is a travel planner, but it also generates payment/order links and QR pages in a way that is not safely scoped to its stated query-only boundary.

Review carefully before installing. Use only if you are comfortable with local itinerary files being created and with the skill generating third-party payment/order links or QR pages. Do not provide real passenger details or payment/order URLs unless you intend them to be saved locally, and verify any generated link manually on the official provider site before paying.

SkillSpector

By NVIDIA

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The skill claims it only performs search/price-comparison behavior and does not handle booking or payment, yet the documentation and examples describe generating payment QR codes, rendering payment URLs, and including passenger-name/order-related fields in generated HTML. Even if payment is completed on a third-party site, packaging payment links and passenger/order data into local output expands the data-handling surface and can mislead reviewers and users about what the skill actually does.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The document first states that passenger PII variables are not read, but later says it auto-loads 'default passenger information' from configuration. That contradiction creates a real risk that operators or future code changes will introduce passenger PII handling despite the stated boundary, undermining trust and making accidental exposure of local sensitive data more likely.

Intent-Code Divergence

Medium

• Confidence: 88% confidence
• Finding: The skill says it does not handle booking or persist PII, but the trip-page workflow instructs collecting order numbers and payment links and embedding them into generated output files. Those artifacts can remain on disk, be copied to Desktop, or be opened in a browser, which increases exposure of booking-related data and creates a persistence channel inconsistent with the stated privacy boundary.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The demo explicitly shows a payment QR code and a '待付款页面链接', which materially undermines the stated safety boundary that the skill does not book or pay. Even if the implementation only generates a third-party payment/deeplink page, presenting payment-ready artifacts can nudge users into unintended transactions and blur the line between planning and commerce, increasing compliance and trust risk.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The demo HTML explicitly presents a payment QR flow and references pending orders, which contradicts the manifest's stated guarantee that the skill only performs search/query operations and does not create orders or process payments. Even if this page is labeled as a demo, such UI can mislead users, reviewers, or integrators into believing payment/order actions are supported, weakening trust boundaries and potentially enabling deceptive flow extension in downstream use.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The mock-mode guide says Tuniu is used for '搜索与预订', which conflicts with the skill's declared query-only, no-booking/no-payment behavior. In a security review, contradictory documentation can mislead operators and auditors about whether the skill may facilitate purchases, increasing the risk of unsafe approval or user misunderstanding about financial side effects.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The documentation describes a 'paymentUrl' and a mock payment QR code, directly undermining the stated no-booking/no-payment boundary. Even if only used for demonstration, payment-oriented artifacts normalize a transactional flow and could hide future scope creep toward order creation, user redirection to payment pages, or collection of purchase-related data.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The comparison table states that real mode generates 'real payment QR codes', which is in direct conflict with the manifest's claim that the skill does not book, pay, or create orders. This kind of contradiction is especially dangerous because it suggests real financial redirection in production behavior, weakening trust in the declared safety model and potentially masking unauthorized payment-related functionality.

Description-Behavior Mismatch

High

• Confidence: 95% confidence
• Finding: The generated HTML includes a 'Scan to Pay' section and an external 'View Orders' link driven by tripData.paymentUrl, which conflicts with the stated skill behavior of only performing search/query actions and not supporting booking or payment. Even if the script itself does not create orders, presenting payment-oriented UI and linking users to a payment/order URL can facilitate unintended transactions, phishing-style redirection, or deceptive handoff to third-party payment pages.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The mock trip payload includes a passenger name, orderId fields, and a paymentUrl, which conflicts with the skill’s declared query-only and no-PII/no-order scope. Even though the data is mock/demo data, these fields can normalize handling of booking/payment artifacts, mislead downstream components into rendering payment flows, and weaken guarantees that no personal or order-related data is processed.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The script explicitly generates an HTML page for '订单支付' using a supplied payment URL and provides a direct payment button, which contradicts the skill's stated guarantee that it only performs search/query functions and never participates in ordering or payment. In a travel-planning skill, this materially expands the trust boundary: an upstream component or malicious caller can feed an arbitrary payment/order URL, causing the skill to facilitate payment flow, phishing, or deceptive redirection under the skill's branding.

Intent-Code Divergence

High

• Confidence: 95% confidence
• Finding: The inline documentation states that the script generates a Tuniu order/payment QR page, confirming that payment-related behavior is intentional and not an accidental comment mismatch. Because the generated HTML embeds a clickable anchor with unsanitized user-supplied URL content, the mismatch between declared capability and implemented behavior increases the risk of social engineering and unauthorized payment facilitation in a context where users were told no booking or payment actions would occur.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: query_trip.js:28

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate-5city-trip.js:20

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/generate-trip-page.js:265

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/query-5city-trip.js:97