ClawHub
Back to skill

Security audit

Travel Planner HY

Security checks across malware telemetry and agentic risk

Overview

This travel-planning skill is mostly transparent about local HTML output and third-party links, but users should not treat its sample payment-looking pages as real checkout pages.

Install only if you are comfortable with a skill that performs travel web lookups, writes local itinerary HTML, and includes third-party booking/payment links for you to open yourself. Treat all prices, QR codes, and Tuniu/12306 links as references only; confirm orders and payments directly on the official third-party site.

SkillSpector

Vulnerability Patterns
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill states it can read the local environment variable `AMAP_API_KEY`, but the skill file does not declare a corresponding permission model. Undeclared secret/environment access weakens reviewability and can mislead operators about what sensitive local data a skill may touch, even if the scope here is limited to one named key.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding
The skill description presents broad capabilities and safety boundaries that do not match the observed implementation characteristics, including missing network/query behavior and an omitted `--open` browser-launch side effect. Description-behavior mismatches are dangerous because users and reviewers may grant trust based on inaccurate disclosures, causing consent, privacy, and operational expectations to break down.

Description-Behavior Mismatch

Medium
Confidence
94% confidence
Finding
The generated page includes a payment-oriented UI with a prominent '扫码支付' section, a '途牛支付' button, order total, and urgency messaging ('30 分钟内完成支付'). This goes beyond neutral itinerary presentation and can nudge users into treating the page as an authoritative checkout surface, increasing phishing, dark-pattern, and trust-confusion risk even if the actual payment occurs on a third-party site.

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The HTML labels the sidebar as '二维码 & 支付' and immediately presents a payment flow, which conflicts with the manifest's claim that the skill does not handle payment. This inconsistency is dangerous because users may reasonably believe the skill has verified or initiated an order, creating deceptive UX and enabling accidental payment to unrelated or stale third-party pages.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical
Code
suspicious.dangerous_exec
Location
scripts/generate-trip-page.js:386