TripGo API

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:32 AM UTC
• Version: 1.0.1

Overview

The skill is a mostly coherent TripGo API wrapper, but it lets authenticated requests use an unvalidated custom API base URL, which could send the user's TripGo API key to an unintended host.

Install only if you trust the scripts and can control the environment in which they run. Keep TRIPGO_BASE_URL unset unless you intentionally use a trusted TripGo-compatible endpoint, avoid passing API keys on the command line, and treat trip coordinates, trip IDs, webhook callback URLs, and analytics calls as potentially sensitive travel data.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/configuration-available-regions.sh:12
• Finding: Unvalidated Custom API Base URL Can Disclose the TripGo API Key<![CDATA[ ## Vulnerability Details **File Location**: `scripts/configuration-available-regions.sh:12, 58-60, 92-97` Additional affected locations: - `scripts/configuration-pois-for-a-transport-mode.sh:12, 85-87, 122-125` - `scripts/configuration-tsps-per-region.sh:13, 47-49, 81-86` - `scripts/geocode-search-and-autocompletion.sh:11, 134-136` - `scripts/locations-additional-details-for-a-coordinate.sh:13, 58-60` - `scripts/locations-pois-for-a-circular-region.sh:12, 47-49` - `scripts/public-transport-departure-timetable-for-a-stop.sh:15, 102-104` - `scripts/public-transport-details-of-a-route.sh:15, 63-65` - `scripts/public-transport-get-details-of-a-service.sh:15, 85-86` - `scripts/public-transport-get-real-time-alerts.sh:15, 49-50` - `scripts/public-transport-operators-for-a-region-or-group-of-regions.sh:15, 99-101` - `scripts/public-transport-real-time-information-for-a-service.sh:18, 61-63` - `scripts/public-transport-routes-for-a-region-or-operator.sh:15, 117-119` - `scripts/public-transport-services-for-a-route.sh:15, 91-93` - `scripts/trips-gets-hooked-urls.sh:9, 28-29` - `scripts/trips-hooks-a-trip-to-real-time-updates.sh:9, 100-101` - `scripts/trips-mark-trip-as-planned-by-a-user.sh:9, 29-30` - `scripts/trips-removes-a-hooks-from-a-trip.sh:9, 28-29` - `scripts/trips-retrieve-previously-computed-trip.sh:9, 26-27` - `scripts/trips-save-trip-for-later-use.sh:9, 28-29` - `scripts/trips-update-trip-with-real-time-data.sh:9, 36-37` - `scripts/ttp-delete-travelling-tourist-problem-deprecated.sh:13, 36-37` **Vulnerability Type**: Unvalidated credential destination / sensitive-header disclosure **Risk Level**: Medium ### Vulnerable Code The representative script accepts an unrestricted API base URL from the environment: ```bash # Configuration TRIPGO_API_KEY="${TRIPGO_API_KEY:-}" TRIPGO_BASE_URL="${TRIPGO_BASE_URL:-https://api.tripgo.com/v1}" ``` It also allows the destination to be supplied directly through a command-line argument: ```bash -u|--ba ...[truncated 3319 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. **Bind credentials to trusted hosts** Permit `X-TripGo-Key` only when the parsed destination hostname exactly matches `api.tripgo.com`, unless an administrator has explicitly configured another trusted hostname. 2. **Require HTTPS** Reject all base URLs that do not use the `https` scheme. Add curl protocol restrictions as defense in depth: ```bash curl --proto '=https' --proto-redir '=https' ... ``` 3. **Validate URLs structurally** Use a reliable URL parser rather than substring or prefix matching. Validate the scheme, normalized hostname, port, user-information component, and path. Avoid checks such as `*tripgo.com*`, which can accept attacker domains such as `tripgo.com.attacker.example`. 4. **Use an explicit endpoint allowlist** If private gateways or test endpoints are required, introduce a separately managed allowlist, such as `TRIPGO_API_HOST_ALLOWLIST`. Custom hosts should require deliberate administrator configuration rather than accepting arbitrary per-call values. 5. **Remove unrestricted command-line destination overrides** Remove `--base-url` where it is not operationally necessary. If retained, apply the same HTTPS and trusted-host validation before constructing any authenticated request. 6. **Validate before adding the credential header** Build the request only after destination validation. Abort without transmitting the API key if validation fails. 7. **Control redirect behavior** The current calls do not explicitly request redirects. Keep redirects disabled unless required. If redirects are enabled later, revalidate every redirect destination and never forward the authentication header to a different origin. 8. **Avoid API keys in command-line arguments** Prefer `TRIPGO_API_KEY` or a protected secret provider over `--api-key`, because command-line arguments may be exposed through process listings, shell history, or automation logs. A hardened validation flow s ...[truncated 575 chars]

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (86)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description presents a broad, multi-capability TripGo integration covering routing, public transport, trip and location services, and geocoding. The supplied code chunk does not implement that broad interface; it only demonstrates one specific API call to a deprecated Travelling Tourist Problem endpoint. While this is TripGo-related, the actual behavior is much narrower and materially different from the stated comprehensive journey-planning and location-services purpose. Therefore the description does not accurately represent this code chunk.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description claims broad TripGo support for routing, public transport, trips, and location services used for multimodal planning and geocoding. The supplied code instead performs one specific destructive API action: deleting a Travelling Tourist Problem by ID through a deprecated endpoint. This is materially different from the stated primary purpose and introduces an undeclared deletion capability. While it does interact with the TripGo API, the behavior is much narrower and of a different kind than the description suggests.

Ae1

High

• Category: analysis-evasion

Content

- `SKILL.md`: This file.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

External Script Fetching

High

• Category: Supply Chain

Content

echo "Making request to: ${URL}"
echo ""

curl -s -X GET "$URL" \
    -H "Accept: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" | python3 -m json.tool

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
# Remove a Hook from a Trip
# DELETE /trip/hook/{id}

set -euo pipefail

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

#!/bin/bash
#
# Delete Travelling Tourist Problem (Deprecated)
# DELETE /ttp/{id}
#
# Deletes the problem of the provided ID.
# This is optional as problems expire automatically.

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence
• Finding: Without declared permissions the skill's intent is opaque and cannot be validated.

External Transmission

Medium

• Category: Data Exfiltration

Content

To use this skill, you must set the following environment variables:

- `TRIPGO_API_KEY`: Your TripGo API key (header: `X-TripGo-Key`). Get it here: https://skedgo.com/tripgo-api/
- `TRIPGO_BASE_URL`: (Optional) Base URL for the API. Defaults to `https://api.tripgo.com/v1`.
- `TRIPGO_WEBHOOK_ALLOWLIST`: (Optional, recommended) Comma-separated allowlist of webhook domains (e.g. `example.com,webhooks.example.org`).
- `TRIPGO_ALLOW_UNSAFE_WEBHOOK`: (Optional, default `false`) Set to `true` to bypass webhook allowlist checks for trusted/manual debugging only.

• Confidence: 83% confidence
• Finding: The skill is designed to transmit data and the `TRIPGO_API_KEY` to an external service, and it also allows the base URL to be overridden via `TRIPGO_BASE_URL`. In context, outbound API calls are expected, but permitting a configurable destination without strong validation can redirect authenticated requests to an attacker-controlled host, causing credential leakage or sensitive trip/location data exfiltration.

External Transmission

Medium

• Category: Data Exfiltration

Content

| X-TripGo-Key | API key (required) |
| Content-Type | application/json |

#### Curl Example
```bash
curl -X POST "https://api.tripgo.com/v1/regions.json" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

| X-TripGo-Key | API key (required) |
| Content-Type | application/json |

#### Curl Example
```bash
curl -X POST "https://api.tripgo.com/v1/regionInfo.json" \
  -H "Content-Type: application/json" \

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The webhook registration endpoint explicitly sends trip identifiers and trip URLs to an arbitrary third-party callback URL, but the documentation does not warn users that trip-related data will be transmitted off-platform. In an agent skill context, this can lead to unintended disclosure of travel data or internal callback destinations if integrators enable webhooks without understanding the privacy and trust implications.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The planned-trip endpoint is described as being for analytics, but the documentation lacks a clear user-facing privacy warning that invoking it records user trip behavior. In a journey-planning skill, trip selection can reveal sensitive location and behavior patterns, so silent analytics collection increases privacy risk and may cause deployments to violate user-consent or disclosure requirements.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Make request
echo "Fetching available regions..."
curl -s -X POST "${TRIPGO_BASE_URL}/regions.json" \
    -H "Content-Type: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \
    -d "$REQUEST_BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

# Make request
echo "Fetching TSPs for region: ${REGION}..."
curl -s -X POST "${TRIPGO_BASE_URL}/regionInfo.json" \
    -H "Content-Type: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \
    -d "$REQUEST_BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script reads an API key from environment variables and later sends user-supplied location inputs to a remote TripGo endpoint. While it prints that it is fetching details, it does not disclose that location data and authentication credentials are being used in an outbound network request.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo ""
echo "Making request..."

curl -s -X POST "https://api.tripgo.com/v1/locations.json" \
  -H "Accept: application/json" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: ${TRIPGO_KEY}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "Making request to $ENDPOINT"
echo "Request body: $BODY"

curl -s -X POST "$ENDPOINT" \
  -H "Content-Type: application/json" \
  -H "X-TripGo-Key: $API_KEY" \
  -d "$BODY" | jq '.'

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "$JSON_payload" | jq '.'
echo ""

curl -s -X POST "${BASE_URL}/waypoint.json" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The script sends origin, destination, modes, locale, and optional trip timing data to the TripGo API via curl. Although it logs the request URL with the API key hidden, it does not clearly warn the user that potentially sensitive travel/location data will be transmitted to a third-party service.

External Transmission

Medium

• Category: Data Exfiltration

Content

echo "$JSON_payload" | jq '.'
echo ""

curl -s -X POST "${BASE_URL}/skedgoify.json" \
    -H "Content-Type: application/json" \
    -H "Accept: application/json" \
    -H "X-TripGo-Key: ${TRIPGO_API_KEY}" \

• Confidence: 70% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.