T08 · Insecure Dependencies
Error
- Location
SKILL.md:118- Finding
Unpinned and Mutable Third-Party Dependencies Can Execute Changed Upstream Code
- Content
View full analysis
- Remediation
View remediation
Security audit
Trip Planner 0to1 Public
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent travel-planning workflow, but it includes under-scoped automatic checks, mutable third-party installs, and unsafe optional cloud-sync credential/data patterns that users should review before installing.
Install only if you are comfortable with a travel skill that can drive web research, authenticated social-media MCP use, generated web pages, optional cloud sync, and deployment steps. Prefer local-only Todo sync, avoid putting GitHub or JSONBin secrets in browser JavaScript, pin and review third-party MCP/Docker/npm components, and treat any update, sudo, Docker, or deployment command as an explicit approval step.
Vulnerability Patterns
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)
T03 · Remote Payload Retrieval and Execution
Error
- Location
references/templates/index-skeleton.html:7- Finding
Generated Pages Execute Remote CDN JavaScript Without Integrity Verification
- Content
View full analysis
... ``` The itinerary page repeats the same pattern: ```html ... ``` ### Technical Analysis The generated HTML loads executable JavaScript from `unpkg.com` every time the page is opened. Although the URL contains a package version, the page supplies no Subresource Integrity hash and does not self-host a reviewed copy. A browser gives this script the same origin-level execution context as the rest of the generated page. If the CDN response or package artifact is compromised, the substituted script can inspect the page, access non-HttpOnly browser storage for that origin, intercept Todo interactions, and read any client-side synchronization credentials. This is especially consequential when the page incorporates `todo-sync.js`, because that template may contain GitHub or JSONBin credentials directly in JavaScript. ### Attack Path 1. An attacker compromises the CDN delivery path, associated package artifact, or upstream publishing account. 2. The generated page requests `leaflet.js` without an integrity constraint. 3. The browser accepts and executes the modified response. 4. The malicious script reads page content, local storage, itinerary information, and JavaScript configuration. 5. If cloud synchronization is enabled, it can steal embedded provider credentials or alter synchronization requests. 6. The script can transmit collected data to an attacker-co ...[truncated 376 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/templates/todo-sync.js:28- Finding
GitHub and JSONBin Master Credentials Are Embedded in Client-Side JavaScript
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
references/cloudflare-workers-sync.md:46- Finding
Recommended Synchronization Services Permit Anonymous Cross-Origin Read and Overwrite
- Content
View full analysis
const m = url.pathname.match(/^\/room\/([a-zA-Z0-9_-]{1,40})$/); if (!m) { return new Response('Not Found', { status: 404, headers: cors }); } const roomId = m[1]; const key = 'room:' + roomId; if (request.method === 'GET') { const data = await env.TRIP_KV.get(key, 'json'); return new Response(JSON.stringify(data || { state: null, ts: 0 }), { headers: { 'Content-Type': 'application/json', ...cors }, }); } if (request.method === 'POST') { const body = await request.json(); if (JSON.stringify(body).length > 256 * 1024) { return new Response('Payload too large', { status: 413, headers: cors }); } await env.TRIP_KV.put(key, JSON.stringify(body)); return new Response(JSON.stringify({ ok: true, ts: body.ts || Date.now() }), { headers: { 'Content-Type': 'application/json', ...cors }, }); } }, }; ``` The self-hosted implementation has the same default access model: ```js const cors = { 'Access-Control-Allow-Origin': '*', 'Access-Control-Allow-Methods': 'GET, POST, OPTIONS', 'Access-Control-Allow-Headers': 'Content-Type', }; if (req.m ...[truncated 3260 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/templates/patch-trip-page-v2.js:28- Finding
Unsanitized Page Name Enables Filesystem Path Traversal in HTML Patchers
- Content
View full analysis
'); process.exit(1); } const src = `/tmp/${pageName}.html`; const dst = `/tmp/${pageName}_patched.html`; let html = fs.readFileSync(src, 'utf8'); ``` After processing, the destination is written without a containment or exclusive-creation check: ```js fs.writeFileSync(dst, html, 'utf8'); ``` The legacy script uses the same construction: ```js const pageName = process.argv[2]; const src = `/tmp/${pageName}.html`; const dst = `/tmp/${pageName}_patched.html`; let html = fs.readFileSync(src, 'utf8'); ... fs.writeFileSync(dst, html, 'utf8'); ``` ### Technical Analysis `pageName` is taken directly from a command-line argument and interpolated into source and destination paths. No strict basename validation, `path.resolve` containment check, or private temporary directory is used. A value containing `../` components can escape `/tmp`. For example, a page name shaped like `../home/user/trip` makes the source resolve to `/home/user/trip.html` and the output resolve to `/home/user/trip_patched.html`. Exploitation requires the targeted source to be readable, contain enough matching marker syntax for processing to continue, and the destination path to be writable by the invoking account. Consequently, this is not unrestricted arbitrary-file overwrite, but it breaks the script's stated `/tmp` boundary. Predictable shared `/tmp` filenames also expose the operation to local races or symlink manipulation when the script runs on a multi-user system with elevated or more privileged a ...[truncated 1088 chars]- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (49)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
声明描述的是一个广泛的旅行规划工作流技能，覆盖信息采集、研究、决策、文档生成、网页生成、同步和部署等多个阶段。实际代码却是一个非常具体的页面后处理工具，仅针对已有 HTML 行程页做增强：提取 marker、按顺序改数字标号、根据注释或距离判断飞行段、向页面注入 JS 以获取 OSRM 驾车路线、绘制飞行/自驾线段、展示里程汇总、添加 Google Maps/Flights 跳转表，并将结果写回新 HTML。两者在主要目的和能力范围上差异显著。虽然都处于“旅行/行程”领域，但该代码只覆盖地图路线可视化与导航链接增强，无法代表声明中的完整旅行攻略生成工作流，因此应判定为不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a broad travel-planning workflow skill covering research, planning, content generation, multi-page UI creation, todo sync, and deployment. The supplied code does not implement that workflow. Instead, it is a narrow utility script for post-processing an already-generated trip page: it parses existing Leaflet markers from HTML, injects route-rendering code, and adds Google Maps navigation links. This is materially different in primary purpose and capability scope. While the code is travel-related, it lacks the core declared functions and instead performs a specific HTML patching/routing enhancement task not described as such.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared description presents a comprehensive travel-planning skill covering research, planning, document generation, web-page creation, and deployment. The supplied code chunk does only one narrow subset: todo checklist UI state management and optional cross-device synchronization. While todo sync is mentioned in the declared description, this code lacks the core claimed capabilities and instead focuses on implementation of local/cloud persistence and DOM interactions for checklist items. Therefore the description does not accurately represent what this code chunk actually does.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 用 `references/templates/patch-trip-page-v2.js` 一键注入路线 + 里程表 + 导航。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 用 `references/templates/patch-trip-page-v2.js` 一键注入路线 + 里程表 + 导航。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | `references/templates/patch-trip-page.js` | v1 兼容（不含里程表） |
Chaining Abuse
High
- Category
- Tool Misuse
- Confidence
- 75% confidence
- Finding
Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.
- Content
重载 nginx：
bash sudo nginx -t && sudo systemctl reload nginx4. 前端配置
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!-- trip-planner 行程详情页骨架（必须包含以下三件套，缺一不可）： 1) Leaflet 地图容器 <div id="map"> + 状态栏 <div id="routeStatus"> 2) marker 列表（每个 L.marker 的 popup 必须含 <strong>地名</strong>）
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
html <!-- trip-planner 行程详情页骨架(必须包含以下三件套,缺一不可): 1) Leaflet 地图容器 <div id="map"> + 状态栏 <div id="routeStatus"> 2) marker 列表(每个 L.marker 的 popup 必须含 <strong>地名</strong>)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 98% confidence
- Finding
The code explicitly defines a Personal Access Token field in client-side configuration, normalizing secret placement in browser code. If a real token is inserted, any viewer can extract it and gain the token's permissions, which for gist scope can allow unauthorized access and modification of synced data.
- Content
js // GitHub Gist 配置（仅 SYNC_BACKEND='gist' 时） const GIST_CONFIG = { token: 'ghp_xxx', // Personal Access Token（scope: gist） gistId: '', // 首次留空，自动创建；后续填写 Gist ID filename: SYNC_ROOM + '.json', };
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The README advertises cloud sync, cross-device Todo synchronization, and three-path deployment but does not warn users that itinerary data, account details, locations, and other travel information may be transmitted to external services. In a travel-planning context, this can expose sensitive personal metadata and lead users to enable networked features without understanding privacy or operational consequences.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation phrases are broad enough to match ordinary travel-related requests, which can cause the skill to load unexpectedly in contexts where the user did not intend to invoke its workflow. Because this skill can drive external research, syncing, and deployment-oriented actions, accidental activation increases the chance of unintended tool use and data exposure.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run an unpinned MCP package via
npx xiaohongshu-mcp@latest, which fetches and executes whatever the latest published code is at runtime. That creates a supply-chain risk: a compromised maintainer account, malicious update, or dependency hijack could lead to arbitrary code execution on the user's system.- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 88% confidence
- Finding
The skill clearly directs use of network-capable actions such as remote version inspection, package retrieval, web research, MCP access, OTA lookups, and deployment, yet it declares no explicit tool scope or permission boundaries. This creates an overbroad execution surface where an agent may perform network operations without transparent least-privilege constraints or user awareness.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The description declares many generic trigger phrases such as '自由行', '做攻略', '旅游计划', 'travel plan', 'itinerary', and '路线规划'. These are broad, common expressions that could match ordinary conversation about travel rather than a clearly scoped invocation condition, and the file does not provide exclusion conditions or negative examples to narrow activation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill description is written entirely in Chinese and centers Chinese-language sources and phrasing without offering any language or locale choice. Under the policy, a skill should not force a specific language or locale unless it is documented as region-specific or gives the user an opt-in choice.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly tells the agent to perform a silent automatic remote version check during load, without a user-facing warning. Hidden network activity reduces transparency, weakens consent, and can leak metadata about skill usage or environment while creating a pathway for remote influence over local behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill instructs the agent to silently perform a remote version check at load and, on user approval, execute a package-management update command. Allowing a content skill to trigger system/package-management operations expands its authority beyond travel planning and introduces supply-chain and arbitrary code execution risk if the upstream package or command path is compromised.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The Docker instruction pulls an image by mutable tag/name only, without a pinned version tag or digest, so future executions may retrieve different or compromised content. In a skill context, this is a supply-chain risk because the agent is being told to fetch and potentially run externally controlled code from a registry.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example Worker implements a publicly reachable
/room/<id>endpoint withAccess-Control-Allow-Origin: *and no authentication for either GET or POST. That means anyone who knows or guesses a room ID can read or overwrite stored trip/Todo state, causing unauthorized disclosure and tampering; the documentation only mentions this as an optional hardening step instead of warning that the default design is insecure.- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
bash # 写 curl -X POST https://trip-sync.your-subdomain.workers.dev/room/test123 \ -H "Content-Type: application/json" \ -d '{"state":{"u0":true},"ts":1714000000000}'
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text ```bash sudo systemctl enable --now trip-sync sudo systemctl status trip-sync
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text ```bash sudo systemctl enable --now trip-sync sudo systemctl status trip-sync
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
text ```bash sudo systemctl enable --now trip-sync sudo systemctl status trip-sync
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 80% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
text ```bash sudo systemctl enable --now trip-sync sudo systemctl status trip-sync
Static analysis
No suspicious patterns detected.