Trip Planner

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:29 AM UTC
• Version: 1.0.0

Overview

The skill is a coherent travel-planning helper, but it asks agents to use logged-in browser sessions and scrape travel/social sites, which users should review before installing.

Install only if you are comfortable with the agent using your browser to read travel prices, reviews, and social-platform content. Keep booking/payment manual, do not let the agent handle passwords or CAPTCHAs, and consider using a separate browser profile or logged-out mode when you do not want account-linked data involved. Prefer pinning the install source and be aware that generated HTML pages load Leaflet JavaScript from a CDN.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:65

Finding

Unpinned npm Installer Execution Creates a Mutable Supply-Chain Risk

Content

View full analysis

Remediation

View remediation

`. 2. Pin the Skill source to an immutable Git commit rather than a mutable repository branch. 3. Publish SHA-256 checksums or signed release artifacts and require verification before installation. 4. Prefer a review-before-install process that downloads the package without executing lifecycle code, verifies it, and only then installs it. 5. Document that users should run installation under a non-administrative account with minimal filesystem permissions. 6. Use npm provenance, lockfiles, and signed releases where supported. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/design-system.md:428

Finding

Generated Itineraries Execute Remote CDN JavaScript Without Integrity Verification

Content

View full analysis

``` The generated example contains the same dependency: ```html ``` ### Technical Analysis The design template directs generated itinerary pages to load executable Leaflet JavaScript from `unpkg.com`. Although the dependency version is pinned to `1.9.4`, the script element does not include a Subresource Integrity hash. The browser therefore trusts whatever response is delivered by the CDN for that URL. A compromise involving the CDN, package publication account, DNS resolution, or upstream artifact could replace the expected Leaflet file with malicious JavaScript. The resulting code would execute in the itinerary page's browser context. The related OpenStreetMap tile requests are declared and necessary for interactive map rendering. The security concern here is specifically the unauthenticated integrity of executable third-party JavaScript, not the ordinary retrieval of map tiles. ### Attack Path 1. An attacker compromises the CDN response path, package publishing account, DNS resolution, or hosted Leaflet artifact. 2. The attacker causes the Leaflet URL to return modified JavaScript. 3. A user opens a generated itinerary while connected to the network. 4. The browser downloads and executes the modified script because no integrity check is present. 5. The malicious script reads accessible itinerary content and page-local state, manipulates the document, redirects the user, or sends ...[truncated 616 chars]

Remediation

View remediation

" crossorigin="anonymous"> ``` 3. Obtain hashes from a trusted release artifact and independently verify them before placing them in the template. 4. Add a restrictive Content Security Policy that limits scripts to the page itself and the explicitly approved CDN, while limiting network connections and images to required OpenStreetMap resources. 5. Update both the design template and existing example files so newly generated and published pages receive the same protection. 6. Continue pinning exact dependency versions and periodically review the bundled or CDN-hosted artifact. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (38)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-user travel itinerary generation skill. The supplied code instead is a QA utility script (check_html.py) that lint-checks a produced HTML artifact for structure, map wiring, hotel/budget/checklist presence, mobile responsiveness, and honesty/provenance heuristics. This is related to the travel-itinerary domain, but it is not the same primary purpose: it neither interacts with users nor creates itineraries nor performs browsing. The extra validator behavior is not merely an implementation detail of the declared skill because the entire code chunk is devoted to post-generation verification rather than the described planning/generation workflow. Therefore the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description is for a user-facing travel itinerary generator. The supplied code does not implement any travel-planning workflow, web research, itinerary construction, budgeting, checklists, or HTML generation. Instead, it is a utility script that opens an already-generated local HTML file in a headless browser and saves screenshots to an output directory. This is a materially different primary purpose and an unrelated capability compared with the declared skill behavior.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 8)May include surrounding context.

html

<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>成都4日游 · 行程计划（带爸妈·悠闲版）</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🐼</text></svg>">
<!-- Leaflet (OpenStreetMap, no API key). Degrades gracefully if it fails to load. -->
<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css">
<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
<!-- Disable browser scroll-restoration so our localStorage restore wins -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 427)May include surrounding context.

md

<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>成都4日游 · 行程计划（带爸妈·悠闲版）</title>
<link rel="icon" href="data:image/svg+xml,<svg xmlns='http://www.w3.org/2000/svg' viewBox='0 0 100 100'><text y='.9em' font-size='90'>🐼</text></svg>">
<!-- Leaflet (OpenStreetMap, no API key). Degrades gracefully if it fails to load. -->
<link rel="stylesheet" href="https://unpkg.com/leaflet@1.9.4/dist/leaflet.css">
<script src="https://unpkg.com/leaflet@1.9.4/dist/leaflet.js"></script>
<!-- Disable browser scroll-restoration so our localStorage restore wins -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 426)May include surrounding context.

html

</div>
</div>

<!-- TOC -->
<div class="toc">
  <div class="toc-title">目录</div>
  <div class="toc-l1">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 500)May include surrounding context.

html

</div>
  </div>

  <!-- The embedded map -->
  <div class="map-card">
    <div id="map"></div>
    <div class="map-legend" id="map-legend"></div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 542)May include surrounding context.

md

</div>
  </div>

  <!-- The embedded map -->
  <div class="map-card">
    <div id="map"></div>
    <div class="map-legend" id="map-legend"></div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 500)May include surrounding context.

html

</div>
  </div>

  <!-- The embedded map -->
  <div class="map-card">
    <div id="map"></div>
    <div class="map-legend" id="map-legend"></div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 542)May include surrounding context.

md

</div>
  </div>

  <!-- The embedded map -->
  <div class="map-card">
    <div id="map"></div>
    <div class="map-legend" id="map-legend"></div>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 712)May include surrounding context.

html

</div>
</div>

<!-- ════ DAY 2 ════ -->
<div class="sec-teal" id="day2">
<div class="section">
  <div class="section-header">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · examples/成都4日游行程.html (reported line 712)May include surrounding context.

html

</div>
</div>

<!-- ════ DAY 2 ════ -->
<div class="sec-teal" id="day2">
<div class="section">
  <div class="section-header">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 501)May include surrounding context.

md

</div>
</div>

<!-- TOC — one .toc-l1 per top block; days list their stops as .toc-l2 -->
<div class="toc">
  <div class="toc-title">目录</div>
  <div class="toc-l1">

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 654)May include surrounding context.

md

<div class="sh-sub">周三 6/24 · 晴 28°C / 19°C · 浅草—墨田区一带</div></div>
  </div>

  <!-- day overview line: 当日花费 + 步数 + 主要点（spend 必须等于预算表里该天的小计） -->
  <div class="day-meta">
    <span class="meta-chip spend"><span class="mc-ico">💰</span>当日 ¥520</span>
    <span class="meta-chip"><span class="mc-ico">👣</span>~9,000 步（≈ 6.5 km）</span>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 654)May include surrounding context.

md

<div class="sh-sub">周三 6/24 · 晴 28°C / 19°C · 浅草—墨田区一带</div></div>
  </div>

  <!-- day overview line: 当日花费 + 步数 + 主要点(spend 必须等于预算表里该天的小计) -->
  <div class="day-meta">
    <span class="meta-chip spend"><span class="mc-ico">💰</span>当日 ¥520</span>
    <span class="meta-chip"><span class="mc-ico">👣</span>~9,000 步(≈ 6.5 km)</span>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 691)May include surrounding context.

md

</div>
  </div>

  <!-- POI card: one per stop. h3 id must match the TOC l2 href so the navigator lists it. -->
  <div class="card poi">
    <div class="poi-head">
      <span class="poi-time">16:30</span>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 753)May include surrounding context.

md

<div class="sh-text"><h2>预算估算</h2><div class="sh-sub">2 人 · 不含购物 · 单位 ¥</div></div>
  </div>
  <div class="card">
    <!-- 固定大项分一组，其余按天拆小计；每个 Day 小计必须等于该天 .day-meta 的「当日花费」 -->
    <table class="budget">
      <thead><tr><th>项目</th><th class="num">明细</th><th class="num">小计 (¥)</th></tr></thead>
      <tbody>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/design-system.md (reported line 753)May include surrounding context.

md

<div class="sh-text"><h2>预算估算</h2><div class="sh-sub">2 人 · 不含购物 · 单位 ¥</div></div>
  </div>
  <div class="card">
    <!-- 固定大项分一组,其余按天拆小计;每个 Day 小计必须等于该天 .day-meta 的「当日花费」 -->
    <table class="budget">
      <thead><tr><th>项目</th><th class="num">明细</th><th class="num">小计 (¥)</th></tr></thead>
      <tbody>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scraping-method.md (reported line 181)May include surrounding context.

• 详情页向下滚动加载点评区
• 容器：[class*="reviewSwiper_reviewSwiper-item__"]（CSS-modules 哈希，前缀匹配）
• 字段前缀：reviewItem-userName / reviewItem-userReviewTime / reviewItem-content
• 坑：① 用户名里被插入零宽字符（​/‍ 等），需 strip；② 轮播 + 列表有重复，需去重；③ 长评论尾部有「全文」按钮，需展开取全文
• 抓全部 1465 条：点「显示所有点评」展开弹层，弹层内翻页/滚动，选择器策略相同

javascript

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scraping-method.md (reported line 186)May include surrounding context.

• 详情页向下滚动加载点评区
• 容器：[class*="reviewSwiper_reviewSwiper-item__"]（CSS-modules 哈希，前缀匹配）
• 字段前缀：reviewItem-userName / reviewItem-userReviewTime / reviewItem-content
• 坑：① 用户名里被插入零宽字符（​/‍ 等），需 strip；② 轮播 + 列表有重复，需去重；③ 长评论尾部有「全文」按钮，需展开取全文
• 抓全部 1465 条：点「显示所有点评」展开弹层，弹层内翻页/滚动，选择器策略相同

javascript

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scraping-method.md (reported line 224)May include surrounding context.

• 详情页向下滚动加载点评区
• 容器：[class*="reviewSwiper_reviewSwiper-item__"]（CSS-modules 哈希，前缀匹配）
• 字段前缀：reviewItem-userName / reviewItem-userReviewTime / reviewItem-content
• 坑：① 用户名里被插入零宽字符（​/‍ 等），需 strip；② 轮播 + 列表有重复，需去重；③ 长评论尾部有「全文」按钮，需展开取全文
• 抓全部 1465 条：点「显示所有点评」展开弹层，弹层内翻页/滚动，选择器策略相同

javascript

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 85% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scraping-method.md (reported line 186)May include surrounding context.

javascript

(() => {
  const strip = s => (s || '').replace(/[​-‏‪-‮⁠]/g, '').trim();
  const items = [...new Set(
    Array.from(document.querySelectorAll('[class*="reviewSwiper_reviewSwiper-item__"]'))
  )];

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 85% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · references/scraping-method.md (reported line 224)May include surrounding context.

javascript

(() => {
  const strip = s => (s || '').replace(/[​-‏‪-‮⁠]/g, '').trim();
  const items = [...new Set(
    Array.from(document.querySelectorAll('[class*="reviewSwiper_reviewSwiper-item__"]'))
  )];

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The guidance explicitly tells the agent to rely on the user's authenticated Chrome session to access login-gated prices and reviews. Using ambient user credentials without an explicit consent and data-minimization boundary can expose private account-linked content and normalize unauthorized access to third-party services.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The section on Xiaohongshu provides detailed scraping tactics, handling of login walls, token limitations, DOM scoping, and rate-control advice to avoid anti-bot triggers. These instructions go beyond benign itinerary rendering and can facilitate extraction from a social platform in ways that bypass normal access controls or platform protections.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 83% confidence

Finding

The README instructs users to install the skill via npx skills add ... without pinning a specific package version. That creates a supply-chain risk: if the resolved package version changes or the upstream package is compromised, users may execute unintended code during installation. In this context, the danger is somewhat increased because the project explicitly encourages one-line installation, making copy-paste execution likely.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.