旅游攻略生成器

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 8:50 AM UTC
• Version: 2.0.0

Overview

This skill is a disclosed travel-guide generator with expected local output, optional Amap routing, and browser-local editing, though users should handle the optional API key carefully and note one dependency maintenance issue.

Install if you are comfortable with the agent using your travel preferences for web research and, optionally, sending route queries plus an AMAP_KEY to Amap. Prefer temporary environment variables or a secrets manager, do not paste API keys into chat, and use Python 3.10+ or update the requests pin where possible.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (45)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description portrays a comprehensive travel-planning skill with itinerary generation, travel content aggregation, route estimation, and formatted HTML output. The supplied code only implements a narrow support function: querying Amap for geocoding and driving-route data, then returning structured JSON. While route calculation is mentioned in the description, the code chunk does not implement the skill’s primary declared behavior such as creating travel guides, producing daily schedules, recommending hotels/food, generating HTML, or handling multilingual outputs. Therefore the code does not accurately represent the broad declared purpose and is materially narrower in scope.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The declared description presents a user-facing end-to-end travel planning skill that takes natural-language trip requests, searches for real攻略 information, uses 高德 API routing, and generates polished multilingual itinerary outputs. The supplied code chunk does only a narrower downstream processing task: it consumes an existing guide JSON, enriches route segments when coordinates are present, adds season tips, validates the structure, renders/export files, and exits. HTML generation is consistent with the description, and route estimation is directionally related, but key advertised capabilities—natural-language trip planning, real-guide search, specific Amap integration, multilingual support, and comprehensive content generation—are not evidenced here. Therefore the code chunk’s actual behavior is materially narrower than the declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a full-featured travel guide generation skill with automatic itinerary planning, external search, route calculation, and rich HTML rendering. The supplied code instead is a narrow exporter: it loads guide data from JSON and serializes it into Markdown, ICS calendar, and GeoJSON files. This is a materially different primary purpose. While the data model may relate to travel guides, the actual code performs no itinerary synthesis, no API/network access, no search, no real-time planning, and no HTML generation. It also adds export behaviors (ICS/GeoJSON) that are not mentioned in the declared description. Therefore the description does not accurately represent the code chunk's actual behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description presents a full travel-planning skill that takes user travel requests, gathers real external information, computes route distances/times via 高德/Amap, and generates a complete itinerary. The provided code chunk is much narrower: it is a renderer for pre-existing structured guide data. It validates input JSON, fills an HTML template, and outputs a static HTML guide. While the rendered sections align with parts of the declared output format (daily itinerary, hotels, food, pitfalls, budget, language attributes), the core promised capabilities—automatic search, route computation via external API, and itinerary generation from user intent—are absent from this code. Therefore the supplied code does not accurately represent the broader declared purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a broad travel-guide generation skill with itinerary planning, content aggregation, API-based routing, and rich HTML output. The supplied code only implements a narrow offline route estimator based on geographic coordinates and fixed heuristic speeds/factors. Its primary purpose is materially different from the declared skill, and key promised capabilities are absent. Although route time estimation could be a supporting subcomponent of a travel planner, this code chunk by itself does not match the declared end-user functionality and explicitly contradicts the claim of using Amap API by operating fully offline.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a comprehensive travel-guide generation skill with automated search, route computation, itinerary synthesis, responsive HTML rendering, and multilingual output. The supplied code chunk does none of those core tasks. It only accepts a destination and query type, then returns hardcoded search keyword templates such as '旅游攻略', '美食推荐', or '避坑指南'. This is at best a small supporting component for a larger travel-planning system, not the described end-user skill itself. Therefore the description materially overstates the code’s actual behavior and primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a comprehensive travel-planning skill with itinerary construction, external search, map routing, HTML rendering, and broad multilingual support. The supplied code only provides a helper for season classification and basic weather/season advice based on an input guide object. This is not merely an implementation detail of the declared skill; it reflects a much narrower and materially different purpose. There is no evidence of the major advertised capabilities, external resource use, or output formats described in the declaration.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full travel-itinerary generation skill with automatic invocation, external search, routing calculations, multilingual content generation, and HTML rendering. The supplied code does none of that. It validates already-structured travel guide JSON for formatting and logical conflicts, using local parsing helpers only. There is no user-trigger handling, no itinerary synthesis, no web/API access, no HTML generation, and no booking/visa/business-trip logic. While the domain is travel guides, the primary purpose is materially different: validation rather than generation.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a full-featured travel-guide generator. The provided code chunk does not implement that functionality; it only contains tests for a routing-related module's fallback behavior when the Amap API key is missing. While Amap routing is mentioned in the description as a supporting component, this specific code chunk is narrowly focused on test validation of API-key/configuration handling and structured error output. That is materially different from the declared primary purpose, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents an end-user travel-planning skill with search, routing API use, itinerary generation, multilingual support, and travel content production. The supplied code chunk does not implement those capabilities directly; it is a test module that verifies behavior of a separate build function and generated HTML/report outputs. While the tested system may relate to guide generation, this specific code's actual purpose is automated testing of export and quality-section behavior, which is materially different from the declared primary purpose.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description describes a full-featured travel-planning skill with itinerary creation, real travel content retrieval, routing via Amap API, budgeting, hotel/food recommendations, and multilingual HTML output. The supplied code chunk does not implement any of those user-facing capabilities. Instead, it contains unit tests for route estimation utilities, specifically checking haversine distance behavior and validation of transport modes. While route estimation could be a supporting component of a travel planner, this chunk’s actual purpose is test coverage for a low-level helper, which is materially different from the declared end-to-end skill behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a full-featured travel-guide generation skill with search, routing, itinerary creation, and formatted output. The supplied code chunk does not implement or demonstrate those core behaviors; it only tests a helper function that formats search queries. While search-query creation could be a supporting detail of a travel planner, this chunk alone is materially narrower than the declared primary purpose. Therefore the description is not accurately represented by the supplied code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a full-featured travel-guide generation skill. The supplied code chunk does not implement that behavior; it only tests a validator for already-structured guide data. While validation could be a supporting internal detail of such a system, this chunk's primary observable purpose is schema and schedule consistency checking, not generating itineraries, searching sources, calling map APIs, or rendering HTML. Therefore the supplied code does not accurately represent the declared skill behavior.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match

Content

# 当前会话临时生效（推荐，关闭终端即失效）
$env:AMAP_KEY="你的key"
# 永久生效（谨慎使用）：系统属性 → 高级 → 环境变量 → 新建用户变量 AMAP_KEY
```

**Windows (CMD)：**
```cmd
set AMAP_KEY=你的key
```

**macOS / Linux：**
```bash
export AMAP_KEY="你的key"
# 临时会话有效；如需持久化，写入 shell 配置文件：
echo 'export AMAP_KEY="你的key"' >> ~/.zshrc   # 或 ~/.bashrc
```

> 也可在运行脚本时临时用 `--key` 参数传入（仅本次运行有效），适合不想配置环境变量的场景。
>
> **密钥管理建议**：优先使用系统密钥管理器（如 macOS Keychain、Windows Credential Manager、云厂商 Secrets Manager）在运行时注入 `AMAP_KEY`；一旦怀疑泄露，立即在高德控制台删除并重新生成该 Key。

### 第四步：验证配置
```bash
python scripts/amap_route.py --origin "威海公园" --destination "火炬八街" --city "威海"
```

• Confidence: 75% confidence
• Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body>

<!-- Hero区域 -->
<div class="hero">
  <div class="hero-inner">
    <div class="emojis">{{EMOJIS}}</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

</head>
<body>

<!-- Hero区域 -->
<div class="hero">
  <div class="hero-inner">
    <div class="emojis">⛰️🌅🥾</div>

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- 交通信息 -->
<section class="transport-card"><h2>🚄 到达与当地交通</h2><div class="transport-grid"><div class="t-item recommend"><span class="badge">推荐</span><div class="t-title">高铁到泰安站</div><div class="t-detail">抵达后换乘公交或打车前往红门游客中心</div><div class="t-price">以购票平台实时价格为准</div><span class="source-badge">通用旅行知识，出发前建议核实 · 2026-09-01</span></div></div></section>

<!-- 酒店推荐 -->
<section class="hotel-section"><h2>🏨 住宿推荐</h2><div class="hotel-grid"><div class="hotel-item"><div class="h-name">红门附近</div><div class="h-price">约 200–450 元/晚</div><div class="h-desc">适合从红门步行登山，减少清晨接驳</div><div class="h-rec">次日可快速前往登山入口</div><span class="source-badge">通用旅行知识，出发前建议核实 · 2026-09-01</span></div></div></section>

<!-- 每日行程 -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Hidden Instructions

High

• Category: Prompt Injection

Content

<!-- 美食推荐 -->
<section class="food-section"><h2>🍜 美食推荐</h2><div class="food-grid"><div class="food-item"><div class="f-name">泰山豆腐宴</div><div class="f-shop">选择明码标价、近期评价稳定的门店</div><div class="f-price">约 60–100 元/人</div><div class="f-note">适合下山后补充热量</div><span class="source-badge">通用旅行知识，出发前建议核实 · 2026-09-01</span></div></div></section>

<!-- 避坑清单 -->
<section class="avoid-section"><h2>⚠️ 避坑清单</h2><div class="avoid-list"><div class="avoid-item"><div class="a-num">1</div><div><span class="a-wrong">只穿短袖上山</span> → <span class="a-right">携带防风外层，并根据实时天气增减衣物</span><a class="source-badge" href="https://www.mount-tai.com.cn/" target="_blank" rel="noopener noreferrer">泰山景区官方信息 · 2026-09-01</a></div></div><div class="avoid-item"><div class="a-num">2</div><div><span class="a-wrong">把估算时间当作固定到达时间</span> → <span class="a-right">至少预留 20% 机动时间，按体力调整</span><span class="source-badge">离线路线估算 · 2026-09-01</span></div></div></div></section>

<!-- 预算估算 -->

• Confidence: 70% confidence
• Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill advertises and instructs use of capabilities including environment variables, file read/write, and network access, but it does not declare a restrictive tool scope such as allowed-tools or permissions. In an agent setting, undeclared capability usage increases the blast radius of prompt injection or misuse because the runtime may grant broader access than users expect.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: This HTML template contains natural-language interface text in Chinese throughout the file, beginning with comments and later user-visible labels such as navigation labels and status messages. Because the skill does not offer user language selection or document that it is intentionally China/Chinese-specific, it appears to force a specific language/locale without opt-in.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This HTML file declares `lang="zh-CN"`, and the visible content and embedded data also fix the language to Chinese. Under the policy, forcing a specific language without user opt-in can be a natural-language locale policy violation when no choice or justification is provided.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The structured `GUIDE_DATA.meta.language` field explicitly sets the content language to `zh-CN`, reinforcing a mandatory locale choice in the generated experience. Because the file does not present this as user-selectable or justified as a region-specific compliance requirement, it fits the language/locale policy violation category.

Vague Triggers

Medium

• Confidence: 91% confidence
• Finding: The description includes very broad natural-language activation examples such as '生成XX攻略' and 'XX几天怎么玩', which are common user phrases and may cause the skill to trigger unintentionally in ordinary travel-related conversations. Overbroad triggering can route user requests to this skill without clear user intent, increasing the chance of unnecessary network access and unexpected handling of user travel-planning content.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The title and descriptive instructions are entirely in Chinese and the specification implicitly requires generated itinerary card content to use that language. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless the restriction is clearly justified as region-specific, which is not stated here.

Known Vulnerable Dependency: requests==2.32.4 — 2 advisory(ies): CVE-2026-25645 (Requests has Insecure Temp File Reuse in its extract_zipped_paths() utility func); CVE-2026-25645 (Requests is a HTTP library. Prior to version 2.33.0, the `requests.utils.extract)

Medium

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: The requirement pins `requests==2.32.4` for Python versions below 3.10, and the finding indicates that versions prior to 2.33.0 are affected by a known vulnerability in `requests.utils.extract_zipped_paths()`. Even if the vulnerable utility is not always exercised, shipping a version with a known CVE is a real supply-chain risk because downstream code or transitive usage may trigger the unsafe behavior.

Static analysis

No suspicious patterns detected.