Trip Planner 0to1 Public

• Outcome: Review
• Latest audit: May 28, 2026 · 10:24 AM UTC
• Version: 2.0.0

Overview

This travel-planning skill is mostly legitimate, but it needs Review because its sync, deployment, credential, and silent update-check instructions can expose private trip data or alter the local environment.

Install only if you are comfortable reviewing and hardening the sync and deployment pieces. Keep Todo sync local by default, do not put real GitHub tokens or JSONBin master keys in browser JavaScript, avoid publishing full booking references or policy numbers, pin and review third-party MCP packages before giving them cookies, and disable or remove the silent version-check behavior.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The skill instructs the agent to silently run a local shell command during load and, if a remote version is newer, to execute `clawhub update trip-planner-0to1`. That is dangerous because it expands a travel-planning skill into arbitrary local command execution and package modification, creating supply-chain and host-integrity risk without prior informed user consent.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill prescribes launching external tooling such as `npx`, Docker, `wget`, and `docker compose` to install or run third-party services locally. This is risky because it can pull and execute untrusted code/images, expose local services, and alter the host environment well beyond the stated purpose of itinerary generation.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The example Worker exposes a public endpoint with `Access-Control-Allow-Origin: *` and allows unauthenticated `GET` and `POST` access to shared room state. Anyone who knows or guesses a room ID can read or overwrite travel Todo data, which is an authorization flaw even if the data is not highly sensitive.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The document presents security controls as optional even though the default deployment permits unauthorized modification of shared state. This is dangerous because users are likely to copy the sample verbatim, resulting in exposed sync endpoints that can be tampered with by third parties.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The template embeds operational deployment steps that go beyond generating a static itinerary page, including writing to /tmp and synchronizing content into /var/www via rsync. In an agent skill context, these instructions can cause an automated system to perform unintended file writes and publication actions, especially if user-provided trip content is later incorporated into deployed HTML without an explicit approval gate.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The template explicitly supports placing GitHub PATs and JSONBin master keys in client-side JavaScript, which exposes those secrets to every page visitor and any script running in the browser. In this travel-planning skill, users may copy the template as-is and accidentally deploy real credentials, enabling unauthorized access to remote storage and abuse of their third-party accounts.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation phrases are broad enough to match ordinary travel-planning requests, which can cause the skill to auto-load in contexts where the user did not explicitly consent to this workflow. Because the skill can drive web research, cross-device sync, and deployment-related actions, accidental activation increases the chance of unintended data handling or downstream system-impacting behavior.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The README advertises cross-device Todo sync and three-path deployment but does not describe what data is stored, where it is sent, what credentials are needed, or what operational risks exist. In a skill that may process itinerary details, account-linked services, locations, and deployment workflows, missing privacy and system-impact warnings can lead users to expose sensitive travel or infrastructure data without informed consent.

Vague Triggers

Medium

• Confidence: 83% confidence
• Finding: The trigger list includes many generic travel terms like '行程规划', 'itinerary', and 'travel plan', making unintended invocation likely in ordinary conversations. Over-broad activation increases the chance the skill's more powerful behaviors—network access, deployment guidance, sync setup, and local command suggestions—are introduced when the user did not intend to use this skill.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The instruction to 'silently execute' a remote version check at skill load time causes undisclosed network access before the user has asked for it. Silent background access is especially risky in agent environments because it can leak usage metadata, normalize hidden behavior, and serve as a precursor to unauthorized updates or other remote interactions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The documentation describes deployment of a publicly reachable state-sync service but does not clearly warn that the sample allows anonymous access by default. In the skill context, this is more dangerous because the workflow is meant for end users to deploy quickly, increasing the chance of insecure copy-paste adoption.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The template directs use of external services (public OSRM routing, Google Maps links, third-party tile/CDN resources) and publishing steps without any user-facing disclosure or consent mechanism. In a travel-planning skill, itinerary locations may reveal sensitive movement patterns, so silent transmission to third parties and silent publication materially increase privacy and data exposure risk.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The template explicitly asks users to record highly sensitive travel identifiers such as PNRs, baggage details, hotel confirmation numbers, rental order numbers, and insurance policy numbers in a single itinerary document. In the context of a trip-planning skill that generates sharable markdown and multi-page web outputs, centralizing these identifiers without any privacy warning or redaction guidance increases the risk of account lookup abuse, social engineering, itinerary exposure, and unintended disclosure when the document is synced, exported, or shared across devices.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The emergency contacts section requests embassy, insurance, rental, credit-card loss, and insurer details, including policy and order identifiers, but provides no warning about protecting account-linked or personally sensitive information. Because this skill is designed for end-to-end itinerary generation and cross-device synchronization, these details may be propagated into broadly accessible documents or hosted pages, increasing exposure to phishing, impersonation, and misuse of account recovery or support workflows.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The injected client-side code automatically sends itinerary coordinates to third-party public OSRM endpoints in the user's browser. In a trip-planning context, waypoint sequences can reveal sensitive travel patterns, lodging locations, or personal movement plans, and this happens without explicit consent or disclosure in the generated page.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code combines credential placeholders with automatic upload support to third-party services, but provides no user-facing warning that real secrets must never be embedded in the shipped page. This creates a realistic misconfiguration path where integrators expose credentials and sync private travel todo data to external platforms unintentionally.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The module uploads todo state and a client identifier fragment derived from the user agent to remote backends automatically once a non-local backend is selected, without any visible consent or disclosure in the UI. Travel todo items can contain sensitive itinerary, packing, timing, and personal planning data, so silent transmission increases privacy and data-governance risk.

External Transmission

Medium

• Category: Data Exfiltration

Content

```bash
# 读空房间（应返回 {state:null,ts:0}）
curl https://your-domain.com/trip-sync/room/test123

# 写
curl -X POST https://your-domain.com/trip-sync/room/test123 \

• Confidence: 94% confidence
• Finding: The example exposes a synchronization endpoint that allows unauthenticated GET and POST operations over the public internet, with CORS set to '*' and predictable room IDs. In the context of a cross-device todo/trip sync service, this can let anyone who knows or guesses a room ID read or overwrite stored state, causing data leakage and tampering.

Static analysis

No suspicious patterns detected.