T09 · Insecure Skill Coding Practices
Error
- Location
scripts/ctrip_flight.py:24- Finding
TLS Certificate and Hostname Verification Disabled
- Content
View full analysis
- Remediation
View remediation
Security audit
携程机票助手 - ctrip flight
Security checks for vulnerabilities and agentic risk
Overview
This flight-search skill is mostly purpose-aligned, but it uses reverse-engineered anti-bot signing code and disables HTTPS verification, which creates review-worthy privacy, integrity, and compliance risk.
Install only if you are comfortable with a Ctrip-specific, reverse-engineered integration that caches Ctrip cookie material locally and runs an obfuscated signing script. The TLS verification bypass should be fixed before normal use, and the quickjs dependency and signing artifact should be pinned and integrity-verified.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:15- Finding
Unpinned QuickJS Dependency Installation
- Content
View full analysis
- Remediation
View remediation
``` 2. Generate and enforce cryptographic hashes: ```bash python3 -m pip install --require-hashes -r requirements.txt ``` 3. Record hashes for all transitive distributions and supported platforms. 4. Use an explicitly trusted package index rather than inheriting arbitrary user or system index configuration. 5. Prefer installation inside a dedicated virtual environment without administrative privileges. 6. Add automated dependency vulnerability and provenance scanning. 7. Update both `SKILL.md` and the runtime error message so they reference the pinned requirements file rather than an unconstrained package command. ]]>
other
Warning
- Location
scripts/ctrip_flight.py:154- Finding
Automatic Execution of Heavily Obfuscated Bundled JavaScript
- Content
View full analysis
str: return _get_csign_ctx().eval(f'module.exports.cSign("{hashlib.md5(body_str.encode()).hexdigest()}")') ``` ### Technical Analysis The bundled JavaScript uses minification, encoded string tables, runtime decoding, and control-flow obfuscation. Its visible behavior includes environment fingerprinting, browser automation checks, cookie inspection, and signature generation. No explicit network API, host command execution, persistence mechanism, or credential theft behavior was identified in the reviewed JavaScript. However, the file is automatically executed and is materially difficult to inspect or maintain. The project also does not verify the file against a trusted cryptographic digest before evaluation. The QuickJS context receives mocked browser globals rather than direct Python filesystem or network objects, which limits the immediate host capabilities visible to this JavaScript. Nevertheless, opaque executable code increases review risk and may consume process resources, manipulate signature output, or exploit vulnerabilities in the native QuickJS binding. ### Attack Path A tampering-bas ...[truncated 1561 chars]- Remediation
View remediation
Vulnerability Patterns
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
The declared purpose is simple flight search, but the skill documentation admits reverse-engineering anti-crawl protections, generating special signatures, and extracting cookies. That behavior materially exceeds normal search functionality and can involve browser fingerprinting, identifier collection, and anti-bot evasion, creating privacy, compliance, and misuse risks not disclosed to the user.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The file contains substantial obfuscated environment-inspection and anti-automation/fingerprinting behavior, including checks over window/document/navigator/screen, plugin enumeration, canvas/WebGL/audio capability inspection, timezone and cookie harvesting, and collection of client identifiers. For a flight-search skill, this exceeds the minimally necessary scope and creates a covert data-collection surface that can track users or fingerprint execution environments without clear necessity or transparency.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The code explicitly disables TLS hostname checking and certificate validation for all outbound HTTPS requests. This makes flight-search traffic vulnerable to man-in-the-middle interception or tampering, allowing an attacker on the network path to alter API responses, inject malicious data, or harvest request metadata and cookies.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares executable behavior that implies file access, network access, and local script usage, but it does not declare any tool scope or permissions boundary. That omission makes the skill harder to sandbox, review, and govern, increasing the chance of unintended file or network operations beyond what users expect from a flight-search skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The manifest says the skill should be used for broad requests like "find the cheapest flights," "flights," and even "any mention of Chinese city pairs with travel dates." Those conditions overlap with common travel conversation and do not clearly distinguish when this specific skill should or should not activate.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documentation explicitly says the skill reverse-engineers and bypasses anti-crawl protections, yet this is not surfaced as a user-facing warning in the main description or prerequisites. Concealing evasion behavior undermines informed consent, masks legal/compliance risk, and makes the skill more dangerous in an agent environment because users and operators may not realize it is performing anti-bot bypass logic.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes a domestic flight search skill, but the shipped code is heavily obfuscated and primarily performs request-signing plus telemetry/environment collection rather than visible flight-query logic. This mismatch is dangerous because it hides non-obvious behavior from reviewers and users, increasing the chance of undisclosed tracking, policy bypass, or supply-chain abuse inside a seemingly benign travel skill.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The module docstring and all user-facing CLI/help text are written only in Chinese, indicating a fixed language/locale experience rather than offering a user choice. Under the policy, locale or language should not be forced unless the constraint is explicitly documented and justified as region-specific.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 76% confidence
- Finding
The trigger and usage examples rely heavily on Chinese phrases and Chinese city/province names, but the skill does not clearly state that it is intentionally Chinese-locale-only or offer any user language/locale choice. That can create a locale policy concern because the language expectation is implicit rather than clearly documented and justified.
- Content