ClawHub
Back to skill

Security audit

aigo hotel search

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed hotel-search skill that connects to an external AIGoHotel MCP service and does not include executable code or hidden persistence.

Before installing, understand that hotel search details such as location, dates, party size, budget, and preferences may be sent to AIGoHotel. Avoid entering personal identifiers in hotel queries, and use a dedicated key if you need higher quota or better request attribution.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:20
Finding

Hardcoded Reusable Bearer Credential

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 20 and 27–34
Vulnerability Type: Hardcoded authorization credential
Risk Level: Medium

Vulnerable Code

markdown
- Built-in Key (`mcp_7d31559a07884aa99be1fa22cdbe828a`) is an official public access key provided by AIGoHotel
json
{
  "mcpServers": {
    "aigohotel-mcp": {
      "url": "https://mcp.aigohotel.com/mcp",
      "type": "http",
      "headers": {
        "Authorization": "Bearer mcp_7d31559a07884aa99be1fa22cdbe828a"
      }
    }
  }
}

Technical Analysis

The Skill embeds a reusable bearer token directly in a distributable configuration document. Although the documentation identifies the token as a public, rate-limited key, it is still an authorization credential accepted by the external MCP service.

Any party with access to the Skill can extract the token and use it independently of the intended Agent. The repository provides no evidence that the credential is bound to a particular client, origin, user, or narrowly constrained request context. Consequently, the service cannot reliably attribute requests made with the shared token to individual callers.

Attack Path

  1. An attacker obtains the publicly distributed Skill package.
  2. The attacker opens SKILL.md and copies the embedded bearer token.
  3. The attacker sends independent HTTP requests to the documented endpoint at https://mcp.aigohotel.com/mcp.
  4. The attacker supplies the copied token in the Authorization header.
  5. If the service accepts the token, the attacker invokes its permitted hotel-search functions or automates requests to consume the shared quota.
  6. Legitimate Skill users may experience throttling or loss of availability under the shared credential.

Impact Assessment

The exposed token may permit unauthorized use of the MCP capabilities assigned to the shared identity and consumption of its rate-limited quota. Potential effects include service abuse, inaccurate request att ...[truncated 360 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the bearer token from SKILL.md and all other distributable project files.
  2. Rotate or revoke the exposed token, even if it was intended for public community use.
  3. Require each user or deployment to provide a dedicated credential through the platform's protected secret-management mechanism.
  4. Inject credentials into MCP headers at runtime rather than storing them in Skill instructions or source control.
  5. Assign each credential only the minimum hotel-search permissions and quota required.
  6. Implement per-user or per-client rate limits, monitoring, revocation, and auditable request attribution.
  7. If the service is intentionally public, replace bearer-token authentication with a genuinely unauthenticated, narrowly scoped endpoint protected by server-side abuse controls.
  8. Add automated secret scanning to repository and release workflows to prevent future credential inclusion.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

该文件整体以中文编写，且未说明这是仅面向中文用户的区域性技能，也未提供语言/locale 选择机制。根据 SQP-3，若技能在自然语言层面强制特定语言而无用户选择或明确、合理的地域性约束，属于语言/locale 策略风险。

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger conditions are broad enough that ordinary conversation about hotels, places, or recommendations could invoke the tool without clear user intent to perform a hotel search. In an agent setting, this can cause unintended tool use, unnecessary data transmission to the tool, and confusion or privacy issues if partial travel details are extracted from casual dialogue.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
90% confidence
Finding

The manifest description and all user-facing instructions are written in Chinese, and the file does not indicate that the skill is region-specific or that users may choose another language. This can violate language/locale policy requirements when a skill effectively forces a specific language without opt-in.

Content

No source excerpt is available for this finding.