travel-planner-plus

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:00 AM UTC
• Version: 1.0.1

Overview

The skill is a travel planner, but it handles API keys and travel-location data with too little user control or privacy disclosure.

Review before installing. Only use this skill if you are comfortable sending trip locations and route details to Baidu Maps and sending generated files through Feishu. Do not let it search general memory files for credentials; provide a scoped Baidu Maps key only for this task, preferably through a dedicated secret mechanism, and remove or avoid logging key prefixes.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:18

Finding

Credential Retrieval from General-Purpose Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 18-21
Vulnerability Type: Credential access beyond least-privilege boundaries
Risk Level: Medium

Vulnerable instruction:

markdown

检查 MEMORY.md 或 TOOLS.md 中是否已有百度AK：
- 如果有：直接使用
- 如果没有：询问用户是否提供百度地图开放平台的AK（用于地理编码和路线规划）

English meaning: Check MEMORY.md or TOOLS.md for an existing Baidu API key. If one exists, use it directly; otherwise, ask the user to provide one.

Technical Analysis

The skill directs the agent to inspect general-purpose persistent state files for a credential and use it automatically. Although a Baidu Maps API key is relevant to route planning, searching broad memory and tool-configuration files is not a least-privilege credential-access mechanism. These files may contain unrelated secrets, private user context, or configuration belonging to other tasks.

The instruction does not establish user consent for accessing a previously stored key, restrict the lookup to a dedicated named secret, or define controls preventing other memory contents from entering the skill context. This creates an unauthorized-access boundary issue even though the reviewed code does not demonstrate exfiltration of unrelated memory.

Attack Path

1. A user activates the travel-planning skill.
2. The skill instructs the agent to inspect MEMORY.md or TOOLS.md.
3. The agent reads persistent files that may contain credentials and unrelated private state.
4. If a Baidu API key is found, the agent uses it without obtaining explicit approval from the current user.
5. The credential becomes available to the skill execution context and may subsequently appear in API requests or logs.

Impact Assessment

The accessible scope is limited by the agent's existing permission to read MEMORY.md and TOOLS.md; this finding does not grant new operating-system privileges. However, it may expose persistent credentials and unrelated private conte ...[truncated 299 chars]

Remediation

View remediation

Remediation Suggestions

• Remove instructions to search general-purpose files such as MEMORY.md and TOOLS.md.
• Request the API key from the user for the current operation, or retrieve it from a dedicated secret manager using an exact identifier such as BAIDU_MAPS_API_KEY.
• Require explicit user authorization before reusing a credential retained from a previous session.
• Limit credential access to the component that performs Baidu API requests.
• Ensure the key is never copied into prompts, generated documents, persistent memory, or diagnostic output.
• Configure provider-side restrictions, including API allowlists, quotas, expiration or rotation policies, and source restrictions where supported.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/generate_travel_guide.py:183

Finding

Partial API Key Disclosure Through Standard Output

Content

View full analysis

Vulnerability Details

File Location: scripts/generate_travel_guide.py, line 183
Vulnerability Type: Sensitive credential exposure in logs
Risk Level: Low

Vulnerable code:

python

print(f"AK: {ak[:10]}...")

Technical Analysis

The script prints the first ten characters of the user-supplied Baidu Maps API key to standard output. Standard output may be retained in agent transcripts, shell history captures, CI logs, centralized monitoring systems, or debugging records.

Secret redaction should not rely on exposing a fixed-length prefix. A ten-character prefix can identify or correlate a key across environments and materially reduces the unknown portion available to an attacker. It may also reveal account or application identifiers if the provider's key format embeds structured information.

The complete key is not printed by this statement, so direct authentication using this output alone is not established. Nevertheless, logging any substantial portion of a secret violates secure credential-handling practices.

Attack Path

1. A user invokes the script and supplies a Baidu Maps API key as the fourth command-line argument.
2. The script assigns that argument to ak.
3. The statement at line 183 writes the first ten key characters to standard output.
4. An execution environment records the output in a transcript or log.
5. A person or service with access to those records obtains the key prefix and can use it for credential correlation, targeted guessing, or confirmation of keys obtained from another source.

Impact Assessment

The immediate disclosure is limited to the first ten characters rather than the complete credential. It does not directly provide additional system privileges or prove that the Baidu account can be accessed.

The exposed prefix can nevertheless assist credential identification and correlation and may increase the impact of another partial disclosure. The scope inc ...[truncated 98 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the API-key logging statement entirely.
• Replace it with a non-sensitive status message, such as:

  python

  print("Baidu Maps API key configured")
  

• Apply centralized secret-redaction filters to process output and agent transcripts as a defense-in-depth measure.
• Avoid passing credentials through command-line arguments because they may be visible in process listings or shell history; use an environment variable, protected configuration file, standard input, or secret manager instead.
• Rotate the key if existing execution logs containing its prefix were accessible outside the intended trust boundary.
• Restrict the key by permitted APIs, usage quota, expiration, and source where the provider supports those controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared behavior does not accurately describe important operational dependencies and data flows, including reliance on an external Baidu API key and transmission of itinerary-related data to third parties. This can mislead users and operators about what the skill actually requires and where user data may be sent, undermining informed consent and safe deployment.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill clearly relies on network access to search the web and call Baidu Map APIs, but it declares no tool scope or allowed-tools constraints. This weakens least-privilege controls and can enable broader-than-expected outbound access if the runtime grants default tool/network capabilities.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill sends user travel details to external services for search/routing and then shares the generated document via Feishu, but the description omits a clear privacy warning and consent model. Travel plans can contain sensitive personal data such as destinations, dates, companions, and preferences, creating privacy and compliance risk when transmitted externally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill description and invocation phrases are entirely in Chinese and direct use through Chinese trigger phrases, with no indication that other languages are supported or that the Chinese-only behavior is intentional and justified. This can violate language/locale policy when the user has not opted into a Chinese-only interaction.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

This endpoint transmits user-supplied location/address data and an API key to Baidu's external service. Even though HTTPS is used, the transmission creates third-party data exposure and secret-handling risk, especially because travel intent and precise places may reveal sensitive personal information.

Content

Scanner excerpt · SKILL.md (reported line 61)May include surrounding context.

text

地理编码API:
https://api.map.baidu.com/geocoding/v3/?address={地点}&output=json&ak={AK}

驾⻋路线API:
https://api.map.baidu.com/direction/v2/driving?origin={lat,lng}&destination={lat,lng}&ak={AK}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The driving-route API sends origin/destination coordinates and an API key to an external provider, exposing detailed movement planning data to a third party. In a travel-planning skill, this context makes the data especially sensitive because it can reveal whereabouts, trip structure, and possible hotel/activity patterns.

Content

Scanner excerpt · SKILL.md (reported line 64)May include surrounding context.

md

https://api.map.baidu.com/geocoding/v3/?address={地点}&output=json&ak={AK}

驾⻋路线API:
https://api.map.baidu.com/direction/v2/driving?origin={lat,lng}&destination={lat,lng}&ak={AK}

公交路线API:
https://api.map.baidu.com/direction/v2/transit?origin={lat,lng}&destination={lat,lng}&ak={AK}

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The transit-route API also transmits precise origin/destination data and an API key to Baidu, creating the same external disclosure risk for itinerary details. Repeated route lookups can further profile a user's trip across multiple locations and times.

Content

Scanner excerpt · SKILL.md (reported line 67)May include surrounding context.

https://api.map.baidu.com/direction/v2/driving?origin={lat,lng}&destination={lat,lng}&ak={AK}

公交路线API: https://api.map.baidu.com/direction/v2/transit?origin={lat,lng}&destination={lat,lng}&ak={AK}

text

### Step 5: 智能排程

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The documented curl-based geocoding call normalizes external transmission of user address data and may encourage unsafe manual secret handling of the API key. While not exploit code, it represents a real privacy and credential-exposure risk if followed in deployment or debugging workflows.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

地理编码（地址→坐标）

bash

curl "https://api.map.baidu.com/geocoding/v3/?address={地址}&output=json&ak={AK}"

返回：{ status: 0, result: { location: { lng: 经度, lat: 纬度 } } }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The transit curl example similarly embeds sensitive coordinates and the API key into a request URL, which may be logged by tooling or proxies. This increases both personal-data exposure and accidental credential leakage risk beyond the baseline third-party transmission concern.

Content

Scanner excerpt · SKILL.md (reported line 114)May include surrounding context.

公交路线规划

bash

curl "https://api.map.baidu.com/direction/v2/transit?origin={lat},{lng}&destination={lat},{lng}&ak={AK}"

返回：{ status: 0, result: { routes: [{ distance: 距离(米), duration: 时间(秒), price: 费用 }] } }

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The driving curl example exposes the same class of risk: external transmission of detailed route data plus API key handling in a URL. In this skill's context, repeated driving-route calls can reveal full travel patterns, making the privacy impact more significant than a generic map lookup.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

驾⻋路线规划

bash

curl "https://api.map.baidu.com/direction/v2/driving?origin={lat},{lng}&destination={lat},{lng}&ak={AK}"

---

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The top-level docstring presents the script as a functional travel guide generator using Baidu Maps for precise route planning. However, the actual execution in main() never calls baidu_geocode(), baidu_direction_transit(), or build_doc(), so the documented behavior contradicts what the script currently does.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file's user-facing description and command usage are presented only in Chinese, and later runtime messages are also Chinese-only. For a general-purpose travel-guide generator, this imposes a specific language/locale without user opt-in or justification, which matches the language-policy violation criteria.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

The function sends user-supplied destination/address data and the Baidu API key to an external third-party service. In the context of a travel-planning skill, such transmission is expected, but it still creates a privacy and data-governance risk because potentially sensitive itinerary or location information leaves the local trust boundary without any visible consent, minimization, or policy enforcement in this code.

Content

Scanner excerpt · scripts/generate_travel_guide.py (reported line 32)May include surrounding context.

python

def baidu_geocode(address, ak):
    """地理编码：地址 -> 坐标"""
    url = f"https://api.map.baidu.com/geocoding/v3/?address={urllib.parse.quote(address)}&output=json&ak={ak}"
    try:
        with urllib.request.urlopen(url, timeout=10) as resp:
            data = json.loads(resp.read().decode())

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This route-planning function transmits origin and destination coordinates plus the API key to Baidu Maps, disclosing detailed movement/location data to an external service. For a travel skill this is functionally relevant, but the skill context also makes the data more sensitive because itinerary and transit patterns can reveal user habits, lodging areas, and planned movements.

Content

Scanner excerpt · scripts/generate_travel_guide.py (reported line 46)May include surrounding context.

python

def baidu_direction_transit(origin, destination, ak):
    """公交路线规划"""
    url = f"https://api.map.baidu.com/direction/v2/transit?origin={origin[1]},{origin[0]}&destination={destination[1]},{destination[0]}&ak={ak}"
    try:
        with urllib.request.urlopen(url, timeout=10) as resp:
            data = json.loads(resp.read().decode())

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest describes a complete travel-planning workflow with automatic search, route calculation, document generation, and delivery. In this file, main() only parses inputs, requires a Baidu API key, prints status, and returns an output path; it never calls the mapping functions, assembles itinerary data, generates the Word document, or sends anything to a user.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.