Self-drive Travel Roadbook

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:53 AM UTC
• Version: 1.0.1

Overview

The skill is a coherent roadbook tool, but it needs review because it sends travel locations to public services and writes local travel/photo files with limited safeguards.

Review and adjust the hard-coded paths before use, and only run it for trips and photos you are comfortable storing on disk and sending to OSRM, Nominatim, Open-Elevation, Amap tile servers, and a Leaflet CDN. Avoid opening generated HTML built from untrusted roadbook text or filenames, and remove the Chrome --no-sandbox usage before relying on PDF/screenshot generation.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_roadbook_html.py:238

Finding

Unescaped Roadbook Content and Filenames Allow HTML Injection

Content

View full analysis

' for p in d['photos']) else: photos_html = '

暂无照片

' spots = d.get('spots', []) via_items = [] for s in spots[:8]: via_items.append(f"

{s[0]} ({s[1]}m)

") via_html = "".join(via_items) if via_items else "—" stories_html = "" for st in d['stories']: stories_html += f'

{st["emoji"]}

{st["text"]}

' ``` Additional unescaped roadbook fields are inserted directly into the generated page: ```python return f'''

{d['day']:02d}DAY

{d['start']} → {d['end']}

{d['date']} · {weekday_str}

{route_str}

``` ```python

🏔️ 途经景点

{via_html}

🏨 住宿

{d['hotel'] or '—'}

💰 消费

{d['cost']}

{stories_html}

{photos_html}

``` ### Technical Analysis The generator treats values parsed from the Markdown roadbook and names read from the photo directory as trusted HTML. These values are interpolated into both element content and quoted attributes without contextual HTML escaping. A crafted field such as a hotel name, route component, sto ...[truncated 1684 chars]

Remediation

View remediation

` and removes event handlers, scripts, embedded resources, and unsafe URL schemes. 6. Add regression tests using payloads in every parsed field and filename, including quotation marks, angle brackets, event handlers, and `javascript:` URLs. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/generate_roadbook_html.py:412

Finding

Headless Chrome Is Invoked with Its Security Sandbox Disabled

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: scripts/generate_map.py:109

Finding

Generated Maps Load Third-Party JavaScript Without Subresource Integrity

Content

View full analysis

``` ### Technical Analysis Generated route maps retrieve executable JavaScript from `unpkg.com` whenever the document is opened. Although the Leaflet version is pinned to `1.9.4`, the response is not protected by a Subresource Integrity hash. The generated HTML also lacks a restrictive Content Security Policy. If the CDN, package publication, DNS resolution, TLS trust chain, or response delivery path is compromised, the browser can execute modified JavaScript without detecting that it differs from the expected Leaflet release. This makes the effective browser-side payload dependent on a remote service after the project itself has been reviewed. ### Attack Path 1. An attacker compromises the CDN response or another component in the remote dependency delivery chain. 2. A user opens a generated route-map HTML file while network access is available. 3. The browser requests `leaflet.js` from the third-party CDN. 4. Because no integrity hash is declared, the browser accepts and executes a modified response. 5. The malicious script runs in the route map's browser context. ### Impact Assessment Successful exploitation permits JavaScript execution in the generated map's browser context. The attacker could alter route information, create deceptive content, issue network requests, and access data exposed to that document context. The direct scope is limited by browser security controls. Operating-system code execution or access to arbitrary local files would require an additional browser weakness or unsafe browser configuration. ]]>

Remediation

View remediation

``` 3. Obtain integrity values from a trusted release source and verify them independently; do not copy unverified hashes from the same delivery channel being protected. 4. Add a restrictive Content Security Policy that limits scripts, styles, images, and network connections to explicitly required sources. 5. Maintain a documented update and integrity-verification process for bundled or remote frontend dependencies. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (12)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill describes capabilities to read and write local files, invoke shell commands, and make network requests, but it does not declare any explicit tool scope or permission boundaries. This creates a broad, under-specified trust surface where an agent could perform sensitive actions on the host filesystem or exfiltrate data without clear user consent or policy enforcement.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs immediate copying of photos from a cache into a desktop folder without an explicit warning or consent step for file-write behavior. Photo files may contain sensitive visual content and EXIF metadata, and automatic persistence to a broad desktop location increases the chance of unintended disclosure or cluttering user files.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill states that map generation automatically calls the OSRM API to obtain routes, but it does not clearly warn the user that itinerary locations will be transmitted to an external service. Travel routes and destinations can reveal sensitive personal movement patterns, so silent network transmission is a privacy risk even if the feature is functionally expected.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The markdown says city labels, place names, and legends default to Chinese, with no indication that the user can select another language. This is a natural-language locale policy issue because it imposes a specific language without opt-in or documented justification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script transmits trip locations to a public third-party OSRM service over the network without any user notice, consent, or offline alternative. In the context of a self-drive travel roadbook tool, itinerary data can reveal sensitive travel plans and destinations, creating a real privacy and data-sharing risk even if the transmission is not overtly malicious.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The generated document explicitly sets lang="zh-CN", and the script’s user-facing strings are entirely in Chinese. Under the policy, forcing a specific language/locale without user opt-in is a natural-language policy violation unless the constraint is clearly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/generate_roadbook_html.py (reported line 418)May include surrounding context.

python

# Step 2: 截图封面地图
    MAP_HTML = "/mnt/c/Users/zhou/Desktop/成都自驾西藏_OSRM路线图.html"
    print(f"📸 正在截图封面地图...")
    subprocess.run([
        "google-chrome", "--headless", "--disable-gpu", "--no-sandbox",
        "--window-size=1400,800",
        "--screenshot=" + COVER_MAP, MAP_HTML

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The manifest describes roadbook creation/update, photo archiving, route-map generation, and PDF generation. While generating maps and HTML is in scope, invoking a local browser binary with subprocess execution adds a host-level execution capability that is broader than the stated tool purpose and is not an obvious requirement from the manifest text alone.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The script sends location-derived data to third-party services (Nominatim and Open-Elevation) over the network, which can expose sensitive travel itinerary information contained in the roadbook. In the context of a self-drive travel planning tool, place names and routes may reveal a user's plans, destinations, and movement patterns, so external transmission increases privacy risk even though the code appears functionally intended rather than malicious.

Content

Scanner excerpt · scripts/lookup_elevation.py (reported line 30)May include surrounding context.

python

def get_elevation(lat, lon):
    """用经纬度查海拔（Open-Elevation API）"""
    url = f"https://api.open-elevation.com/api/v1/lookup?locations={lat},{lon}"
    req = urllib.request.Request(url, headers={'User-Agent': 'RoadbookBot/1.0'})
    try:
        with urllib.request.urlopen(req, timeout=10) as resp:

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The output HTML sets lang="zh-CN" and uses exclusively Chinese UI text, which enforces a specific language/locale in the generated user-facing artifact. There is no indication that the locale is optional, configurable, or limited to a documented region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code writes derived route data to /tmp/roadbook_routes_cache.json, which is a file write affecting local user data. Although the script prints the final HTML output path, there is no warning, comment, or docstring disclosing that an additional cache file will be created.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This code file contains natural-language strings such as the module docstring, usage text, and status messages exclusively in Chinese. Under the policy rule, forcing a specific language without user opt-in is a locale/language policy violation unless the constraint is explicitly documented and justified.

Content

No source excerpt is available for this finding.