ClawHub
Back to skill

Security audit

Travel Planner HY

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is coherent and bounded, with disclosed local file output and restricted public travel-site fetching.

Install this only if you are comfortable with a Node-based skill that writes local itinerary files and can fetch public pages from its listed travel domains. Do not include identity documents, payment details, account links, API keys, tokens, or booking/order information in trip inputs, URLs, or search terms.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (19)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · .gitignore (reported line 1)May include surrounding context.

text
.env
.env.*
node_modules/
output/

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

The declared description centers on travel itinerary planning, attraction research, comparison of travel options, and HTML export. This code does not implement itinerary construction, comparison logic, export generation, QR code creation, or any travel-domain behavior. Instead, its primary purpose is to securely retrieve remote guide content from a public HTTPS URL. While remote fetching could be a supporting detail for 'research public attractions,' this chunk is a generic URL fetch utility and its behavior is materially different from the declared end-user functionality. Therefore, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

The declared description promises a user-facing travel itinerary planner/exporter. The code chunk, however, is not implementing itinerary planning behavior; it is a test file focused on security controls around related modules. While some tested features align indirectly with the description—such as exporting HTML, QR codes, and fetching public attraction guides—the actual code shown primarily exercises security behaviors: input sanitization, schema enforcement, safe URL allowlisting, SSRF prevention, timeout handling, file path containment, symlink rejection, and dependency integrity checks. Those are materially different from the declared primary purpose and include undeclared capabilities like network/DNS handling and filesystem security enforcement. Therefore this code chunk does not accurately match the declared description.

Content

No source excerpt is available for this finding.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

md
`qrcode@1.5.4` 和 `ipaddr.js@2.2.0` 固定版本，全部依赖由 `package-lock.json` 锁定。安装访问官方 npm registry，运行时不会下载代码。`.npmrc` 禁用安装脚本。

Credential Access

High
Category
Privilege Escalation
Confidence
70% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 42)May include surrounding context.

npm test

text

`qrcode@1.5.4` 和 `ipaddr.js@2.2.0` 固定版本，全部依赖由 `package-lock.json` 锁定。安装访问官方 npm registry，运行时不会下载代码。`.npmrc` 禁用安装脚本。

链接读取失败或域名未获允许时，使用用户提供的公开摘录或已获取的安全搜索摘要，并说明资料缺失；不要通过关闭 TLS、改变地址写法、换代理或解除地址校验继续访问。需要增加来源时，应维护明确的域名白名单并复查测试，不能由页面内容自行扩权。

Credential Access

High
Category
Privilege Escalation
Confidence
92% confidence
Finding

The package explicitly includes .npmrc in the published files list, which can expose registry configuration and potentially authentication tokens if the file contains credentials. In an npm package, publishing configuration files is unnecessary for runtime and increases the risk of credential leakage to anyone who can access the package contents.

Content

Scanner excerpt · package.json (reported line 46)May include surrounding context.

json
"README.md",
    "skill-card.md",
    "package-lock.json",
    ".npmrc"
  ],
  "dependencies": {
    "qrcode": "1.5.4",

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · tests/security.test.js (reported line 99)May include surrounding context.

js
});

test('address classification blocks special IPv4 and IPv6 ranges', () => {
  for(const address of ['127.0.0.1','10.0.0.1','172.16.1.1','192.168.1.1','169.254.169.254','100.64.0.1',
    '0.0.0.0','224.0.0.1','192.0.2.1','198.51.100.1','203.0.113.1','198.18.0.1','255.255.255.255',
    '::1','::','fc00::1','fe80::1','ff02::1','2001:db8::1','::ffff:127.0.0.1','2002:7f00:1::','64:ff9b::a00:1','bad']) assert.equal(isPublicAddress(address),false,address);
  assert.equal(isPublicAddress('93.184.216.34'),true);assert.equal(isPublicAddress('2606:4700:4700::1111'),true);

Cloud Metadata Access

High
Category
Server-Side Request Forgery
Confidence
90% confidence
Finding

Code accesses a cloud instance metadata endpoint (e.g. 169.254.169.254). A single request can return temporary IAM credentials, making this a high-value SSRF target for credential theft.

Content

Scanner excerpt · tests/security.test.js (reported line 136)May include surrounding context.

js
});

test('address classification blocks special IPv4 and IPv6 ranges', () => {
  for(const address of ['127.0.0.1','10.0.0.1','172.16.1.1','192.168.1.1','169.254.169.254','100.64.0.1',
    '0.0.0.0','224.0.0.1','192.0.2.1','198.51.100.1','203.0.113.1','198.18.0.1','255.255.255.255',
    '::1','::','fc00::1','fe80::1','ff02::1','2001:db8::1','::ffff:127.0.0.1','2002:7f00:1::','64:ff9b::a00:1','bad']) assert.equal(isPublicAddress(address),false,address);
  assert.equal(isPublicAddress('93.184.216.34'),true);assert.equal(isPublicAddress('2606:4700:4700::1111'),true);

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill declares runtime requirements for Node and explicitly documents use of environment variables and local command execution, but it does not declare an explicit tool/permission scope. That creates a governance gap: hosts may expose broader shell or environment access than users expect, increasing the chance of unintended command execution or sensitive environment exposure if the implementation or wrapper is later changed.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The entire skill specification, parameter schema, parsing rules, and confirmation template are written exclusively in Chinese, including the required user-facing confirmation prompt. This indicates the skill is designed to operate in a fixed language without documenting any user choice or opt-in, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

This markdown file contains user-facing instructions exclusively in Chinese, and nowhere indicates that the skill is region-specific or that users may opt into another language. Under the policy, forcing a specific language without user choice is a natural-language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This markdown file contains all user-facing guidance in Chinese, and there is no indication that users may opt into another language or that the skill is intentionally limited to a Chinese-only regional context. The policy specifically calls for flagging language or locale constraints when they are forced without user opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The mock-trip generator hard-codes Chinese content and later the CLI restricts language choices to zh-CN or en, with Chinese as the default in generated data. This is a natural-language policy concern because the skill forces a specific locale unless the user explicitly overrides it, and the file does not document a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The validation logic rejects any language other than 'zh-CN' or 'en' via a hardcoded allowlist. This is a natural-language locale policy constraint, and in this file there is no visible user-choice flow or documented regional justification for forcing that limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The document declares lang="zh-CN" and presents the visible title/content entirely in Chinese, which indicates a fixed language/locale choice. Under the policy criteria, forcing a specific language without offering user choice or documenting a justified regional constraint is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This JSON mock data presents the title, subtitle, destination details, and language as Chinese/zh-CN only. Because SQP-3 applies to all file types, hard-coding a specific language/locale without any indication of user selection or documented justification can violate language/locale policy expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
31% confidence
Finding

This lockfile includes the y18n package, which is commonly used for localization and language-specific output. However, a package-lock entry alone does not show any natural-language behavior, forced locale, or user-facing language policy; the evidence for an actual policy violation is weak.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
91% confidence
Finding

This markdown file contains user-facing guidance exclusively in Chinese, with no indication that language selection is optional or contextually justified. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in can be a locale/language policy violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

This JavaScript file contains natural-language comments and embedded descriptive content exclusively in Chinese, including the module description and all travel metadata. Under the policy, forcing a specific language without offering user choice or documenting a justified locale constraint is a language/locale policy violation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.