travel-city-game(旅行游戏副本生成器)

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:34 AM UTC
• Version: 1.0.9

Overview

This travel-page skill is purpose-aligned overall, but it needs review because external travel data is inserted into auto-opened HTML in unsafe ways and it relies on an unpinned FlyAI dependency.

Review before installing. Use it only if you trust the FlyAI skill/CLI source, avoid feeding private travel plans into pages you may publish, and prefer local-only preview unless you intentionally want a public URL. Generated pages should treat FlyAI product names, images, and links as untrusted until the template escapes text safely and validates URLs.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: assets/template.html:294

Finding

Externally Sourced Travel Data Enables Stored HTML and JavaScript Injection

Content

View full analysis

' + LOADING_STEPS[i] + ''; } document.getElementById('loadingSteps').innerHTML = stepsHtml; ``` ```javascript if (node.status === 'unlocked') { buttons = '

前往预订

'; } else if (node.status === 'in_progress') { buttons = '

' + '查看订单' + '确认到店 (模拟核销)' + '

'; } html += '

' + '' + '

' + '' + (i + 1) + '' + '' + node.chapter + ': ' + node.title + '' + '' + statusTextMap[node.status] + '' + '

"' + node.story + '"

' + '

📍 ' + node.address + '  |  🎫 ' + node.skuName + '

' + buttons + '

'; container.innerHTML = html; ``` ```javascript for (var i = 0; i < gameState.rewards.length; i++ ...[truncated 3387 chars]

Remediation

View remediation

` as `\u003e`. - Escape `&` as `\u0026`. - Escape U+2028 and U+2029. - Ensure `` cannot terminate the containing script element. - Prefer embedding data in an `application/json` element and parsing its `textContent`. 3. Apply strict URL validation: - Parse URLs with a standards-compliant URL parser. - Permit only `https:` for remote booking and image resources. - Reject embedded credentials, control characters, malformed hosts, and unexpected ports. - Where feasible, allowlist official FlyAI or Fliggy destination hosts. - Reject `javascript:`, `data:`, `file:`, `blob:`, and other unneeded schemes. 4. Add `rel="noopener noreferrer"` to every external link using `target="_blank"`. 5. Treat every external CLI response as untrusted, even if it is valid JSON. 6. Add a restrictive Content Security Policy that disallows inline event handlers and limits scripts, images, and navigation destinations. Refactoring inline handlers should precede enabling a strict policy. 7. Add security tests containing payloads with quotes, angle brackets, ``, event handlers, malformed URLs, and Unicode separator characters. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:9

Finding

External FlyAI Skill Dependency Is Not Version or Digest Pinned

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill description presents a travel-itinerary generator, but the instructions also include undeclared side effects like starting background services, opening a browser, managing long-lived processes, and optional public deployment. This mismatch is dangerous because users and orchestrators may authorize or trigger the skill under false assumptions, allowing behaviors beyond the expected trust boundary.

Content

No source excerpt is available for this finding.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 1)May include surrounding context.

html

<!-- ⚠️ 【只读模板文件 - READ-ONLY TEMPLATE】⚠️
     此文件是源模板，AI/Copilot 在任何情况下都 **禁止修改** 此文件。
     - 只能"读取"此文件内容，不能"写入"或"编辑"。
     - 输出结果必须写入 outputs/ 目录（如 outputs/city-game-长沙.html）。

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · assets/template.html (reported line 1)May include surrounding context.

html

<!-- ⚠️ 【只读模板文件 - READ-ONLY TEMPLATE】⚠️
     此文件是源模板,AI/Copilot 在任何情况下都 **禁止修改** 此文件。
     - 只能"读取"此文件内容,不能"写入"或"编辑"。
     - 输出结果必须写入 outputs/ 目录(如 outputs/city-game-长沙.html)。

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes shell commands, writes output files, starts a local HTTP server, and can deploy content publicly, yet it declares no explicit tool scope or allowed-tools restrictions. That increases the blast radius if the skill is mis-triggered or later modified, because the agent may exercise filesystem, process, and network capabilities without manifest-level guardrails.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The trigger phrases are broad enough to match ordinary travel-planning requests, causing the skill to activate in situations where the user did not specifically ask for file generation, shell execution, browser launch, or possible publication workflows. Overbroad triggering is risky here because this skill has side effects beyond pure text generation, so accidental invocation can lead to unnecessary command execution and file/network activity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill includes one-command deployment of generated HTML to a public hosting service, which extends well beyond local page generation. Publishing content to the internet can expose user-provided itinerary content, embedded links, and generated narratives to unintended audiences, especially if users do not fully understand that the result becomes publicly accessible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The deployment instructions encourage uploading the generated HTML to a public URL but do not prominently warn that the result will be internet-accessible. Because the page contains user-selected city context, generated content, and external booking links, users may unknowingly disclose information or create publicly reachable content they assumed would remain local.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring and all user-facing messages are written only in Chinese, which imposes a specific language on users without any opt-in or alternative locale handling. This matches the language/locale policy violation category because the file hard-codes a single language for interaction.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/serve.py (reported line 36)May include surrounding context.

python

防止 PID 被系统复用后误杀其他程序。
    """
    try:
        result = subprocess.run(
            ["ps", "-p", str(pid), "-o", "command="],
            capture_output=True, text=True, timeout=3
        )

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 76% confidence

Finding

The manifest presents the skill as taking a city name and generating a narrative itinerary, with a dependency on flyai, but does not mention handling credentials or requiring environment-based API authentication. The instructions explicitly tell the user to configure FLYAI_API_KEY in the environment so the CLI can authenticate, which introduces credential handling outside the stated end-user purpose.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The HTML document hard-codes lang="zh-CN", and the visible interface text throughout the template is also fixed in Chinese. This creates a locale-specific user experience without offering opt-in, fallback, or documenting that the skill is intentionally region-specific.

Content

No source excerpt is available for this finding.