Security audit
Security checks for vulnerabilities and agentic risk
The hotel-search workflow fits its purpose, but it sends your API key and destination searches over an unencrypted connection.
Before using this version, verify who operates the POI service and require an authenticated HTTPS integration. Supply only a key issued for that service, and rotate any key already used over this HTTP connection. The artifacts support a transport-security concern, without establishing deliberate credential theft.
travel_agent.pyAPI key transmitted in plaintext over HTTP
An observer can capture the API key and replay it against the POI service within that key's privileges. Search locations are also exposed, and an active intermediary can alter returned POI data.
The skill sends GAODE_POI_KEY in an X-API-Key header to a hardcoded IP address over unencrypted HTTP, exposing the credential and destination queries to network observers. An on-path attacker can also alter POI responses and influence subsequent hotel searches; sending an API credential to its intended service is normal, but this transport provides neither confidentiality nor server authentication, and the endpoint's ownership is not established by the code.
def gaode_get(path, params, key):
url = GAODE_BASE + path + "?" + urllib.parse.urlencode(params)
req = urllib.request.Request(url, headers={"X-API-Key": key})
with urllib.request.urlopen(req, timeout=15) as r:
return json.loads(r.read())
Without declared permissions the skill's intent is opaque and cannot be validated.
The documented POI endpoint uses plain HTTP and receives location queries and an X-API-Key header, exposing both to network observers and allowing an active intermediary to modify responses. Sending destination queries is expected for this skill, but unencrypted transport is not necessary; keeping the key out of files does not protect it in transit, and the documentation does not warn users of this exposure.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
cmd += ["--hotel-stars", stars]
if max_price:
cmd += ["--max-price", str(max_price)]
res = subprocess.run(cmd, capture_output=True, text=True, timeout=45)
if res.returncode != 0:
sys.stderr.write(res.stderr)
sys.exit(res.returncode)
Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.
cmd += ["--hotel-stars", stars]
if max_price:
cmd += ["--max-price", str(max_price)]
res = subprocess.run(cmd, capture_output=True, text=True, timeout=45)
if res.returncode != 0:
sys.stderr.write(res.stderr)
sys.exit(res.returncode)
No suspicious patterns detected.