SkedGo TripGo API

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 1:36 AM UTC
• Version: 1.0.3

Overview

This is a coherent TripGo API helper skill, but users should treat API keys and travel/location data as sensitive when running its scripts.

Install only if you trust TripGo with the travel, location, trip, and webhook data you send. Keep TRIPGO_API_KEY private, prefer the default official HTTPS API URL, do not set TRIPGO_BASE_URL to untrusted hosts, and use the webhook allowlist rather than the unsafe bypass except for controlled debugging.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configuration-available-regions.sh:12
• Finding: TripGo API Credential Disclosure Through Unrestricted Base URL Overrides<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/configuration-available-regions.sh:12,58-60,94-97` - `scripts/configuration-pois-for-a-transport-mode.sh:12,85-87,124-125` - `scripts/configuration-tsps-per-region.sh:13,47-49,83-86` - `scripts/geocode-search-and-autocompletion.sh:10-11,104,134-136` - `scripts/locations-additional-details-for-a-coordinate.sh:12-13,58-60` - `scripts/locations-pois-for-a-circular-region.sh:11-12,47-49` - `scripts/public-transport-departure-timetable-for-a-stop.sh:14-15,102-105` - `scripts/public-transport-details-of-a-route.sh:14-15,63-66` - `scripts/public-transport-get-details-of-a-service.sh:14-15,85-86` - `scripts/public-transport-get-real-time-alerts.sh:14-15,49-50` - `scripts/public-transport-operators-for-a-region-or-group-of-regions.sh:14-15,99-102` - `scripts/public-transport-real-time-information-for-a-service.sh:17-18,61-64` - `scripts/public-transport-routes-for-a-region-or-operator.sh:14-15,117-120` - `scripts/public-transport-services-for-a-route.sh:14-15,91-94` - `scripts/trips-gets-hooked-urls.sh:8-9,28-31` - `scripts/trips-hooks-a-trip-to-real-time-updates.sh:8-9,100-104` - `scripts/trips-mark-trip-as-planned-by-a-user.sh:8-9,29-32` - `scripts/trips-removes-a-hooks-from-a-trip.sh:8-9,28-31` - `scripts/trips-retrieve-previously-computed-trip.sh:8-9,26-29` - `scripts/trips-save-trip-for-later-use.sh:8-9,28-31` - `scripts/trips-update-trip-with-real-time-data.sh:8-9,30,36-39` - `scripts/ttp-delete-travelling-tourist-problem-deprecated.sh:12-13,36-37` **Vulnerability Type**: Credential disclosure through an unrestricted, user-configurable network destination **Risk Level**: Medium ### Vulnerable Code A representative source and sink appear in `scripts/configuration-available-regions.sh`: ```bash TRIPGO_API_KEY="${TRIPGO_API_KEY:-}" TRIPGO_BASE_URL="${TRIPGO_BASE_URL:-https://api.tripgo.com/v1}" ``` The destination can also be changed through a command-line option: ```bash -u|--base-url) TRIPGO_ ...[truncated 3951 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Prefer a fixed official origin** If custom TripGo deployments are not required, remove `TRIPGO_BASE_URL` and `--base-url` support and use a constant HTTPS origin: ```bash readonly TRIPGO_BASE_URL="https://api.tripgo.com/v1" ``` 2. **Require HTTPS** Reject destinations that do not begin with `https://`: ```bash if [[ ! "$TRIPGO_BASE_URL" =~ ^https:// ]]; then echo "Error: TRIPGO_BASE_URL must use HTTPS" >&2 exit 1 fi ``` 3. **Validate the hostname against an explicit allowlist** Parse the URL using a robust URL parser and require the normalized hostname to match an approved TripGo host or explicitly configured enterprise deployment. Do not rely on substring matching, which can accept names such as `api.tripgo.com.attacker.example`. 4. **Separate custom endpoints from credential forwarding** Never attach `X-TripGo-Key` to an untrusted destination. Resolve and validate the destination before constructing the authenticated request. 5. **Constrain curl protocol and redirect behavior** Use settings such as: ```bash curl --proto '=https' \ --proto-redir '=https' \ --max-redirs 0 \ --fail-with-body \ --silent \ --show-error \ ... ``` If redirects are required, validate every redirect destination before forwarding authentication headers. 6. **Avoid API keys in command-line arguments** Remove or discourage `--api-key`, because command-line values may be exposed through process listings and shell history. Prefer a protected environment variable, secure file descriptor, or secret manager. 7. **Fail closed on placeholder credentials** Scripts using values such as `YOUR_API_KEY` or `your-api-key-here` should reject those placeholders explicitly rather than transmitting them. 8. **Apply the validation centrally** Introduce a shared request helper that validates the scheme and hostname and adds authenticatio ...[truncated 439 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (93)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The description presents a broad, comprehensive TripGo API integration covering routing, public transport, trips, and location services. The supplied code chunk, however, only performs one narrow action: creating a travelling tourist problem via the deprecated /ttp/ endpoint using a fixed example payload. While this does access the TripGo API, it does not substantiate the broader declared capabilities such as routing, public transport data retrieval, trip management, or geocoding. This is a material scope mismatch between the declared purpose and the actual behavior of the provided code.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description presents a broad multimodal journey-planning and location-services interface for the TripGo API. The supplied code chunk instead performs one specific action: deleting a Travelling Tourist Problem by ID through a deprecated endpoint. While it does interact with the TripGo API, its primary purpose is materially narrower and different from the declared functionality. This is a description-behavior mismatch because the code does not provide the described routing, public transport, trip, or geocoding capabilities, and instead exposes a specific delete operation not reflected in the description.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The declared description presents the skill as a broad interface for journey planning, public transport, trips, and geocoding. The supplied code instead implements one very specific deprecated endpoint for retrieving a travelling tourist problem solution from /ttp/{id}/solution. That specialized optimization/problem-solving capability is materially different from and narrower than the declared purpose, and the accessed resource family (/ttp) is not reflected in the description. Therefore the description does not accurately represent the actual behavior of this code chunk.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md`: This file.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

echo "Making request to: ${URL}"
echo ""

curl -s -X GET "$URL" \
    -H "Accept: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
# Remove a Hook from a Trip
# DELETE /trip/hook/{id}

set -euo pipefail

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
#
# Delete Travelling Tourist Problem (Deprecated)
# DELETE /ttp/{id}
#
# Deletes the problem of the provided ID.
# This is optional as problems expire automatically.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium

• Category: Data Exfiltration

Content

To use this skill, you must set the following environment variables:

- `TRIPGO_API_KEY`: Your TripGo API key (header: `X-TripGo-Key`).
- `TRIPGO_BASE_URL`: (Optional) Base URL for the API. Defaults to `https://api.tripgo.com/v1`.
- `TRIPGO_WEBHOOK_ALLOWLIST`: (Optional, recommended) Comma-separated allowlist of webhook domains (e.g. `example.com,webhooks.example.org`).
- `TRIPGO_ALLOW_UNSAFE_WEBHOOK`: (Optional, default `false`) Set to `true` to bypass webhook allowlist checks for trusted/manual debugging only.

• Confidence: 83% confidence
• Finding: This skill is explicitly designed to transmit requests, including the `X-TripGo-Key` credential, to an external service and allows the base URL to be overridden via `TRIPGO_BASE_URL`. That creates a real exfiltration and SSRF-style risk if an attacker can influence environment variables or configure the skill to send secrets to an untrusted host; the optional unsafe webhook bypass further increases exposure in webhook-related flows.

External Transmission

Medium

• Category: Data Exfiltration

Content

| X-TripGo-Key | API key (required) |
| Content-Type | application/json |

#### Curl Example
```bash
curl -X POST "https://api.tripgo.com/v1/regions.json" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| X-TripGo-Key | API key (required) |
| Content-Type | application/json |

#### Curl Example
```bash
curl -X POST "https://api.tripgo.com/v1/regionInfo.json" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

## Base URL
```
https://api.tripgo.com/v1/
```

## Authentication

• Confidence: 88% confidence
• Finding: This skill directs outbound communication to an external domain, which creates a real data-exfiltration surface because requests may contain API credentials and potentially sensitive trip, stop, and timing data. While contacting a vendor API is expected for this skill, the risk is still real and should be treated as an external transmission boundary requiring review and user awareness.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The routing documentation instructs users to send precise coordinates, waypoint history, habitual locations such as home and work, and itinerary timing to a third-party API, but it provides no privacy warning or data-handling caution. In a journey-planning skill, this omission increases the risk that integrators will unknowingly transmit highly sensitive location data without user notice, minimization, or consent controls.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The webhook feature states that the platform will POST tripID and tripURL to a registered external URL, but it does not provide an explicit warning about data sharing, retention, or third-party exposure. Because trip URLs may grant access to trip details and may correlate with user travel behavior, sending them to arbitrary endpoints creates a real privacy and potential unauthorized-access risk.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The documented trip APIs include analytics and tracking-related capabilities such as planned/progress/log URLs that extend beyond the manifest’s stated scope of journey planning, public transport, and geocoding. This scope expansion increases privacy and data-governance risk because an integrating agent could collect or transmit user behavior data without users expecting those functions from this skill.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Make request
echo "Fetching available regions..."
curl -s -X POST "${TRIPGO_BASE_URL}/regions.json" \
    -H "Content-Type: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \
    -d "$REQUEST_BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Make request
echo "Fetching TSPs for region: ${REGION}..."
curl -s -X POST "${TRIPGO_BASE_URL}/regionInfo.json" \
    -H "Content-Type: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \
    -d "$REQUEST_BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo ""
echo "Making request..."

curl -s -X POST "https://api.tripgo.com/v1/locations.json" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: ${TRIPGO_KEY}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "$JSON_payload" | jq '.'
echo ""

curl -s -X POST "${BASE_URL}/waypoint.json" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.