ClawHub
Back to skill

Security audit

途牛酒店预订技能

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent Tuniu hotel assistant, but it needs review because it can create real bookings and send API keys and personal booking details through broadly scoped shell curl commands.

Install only if you are comfortable sending hotel search and booking details to Tuniu. Keep TUNIU_MCP_URL unset or pinned to the official HTTPS endpoint, use a narrowly scoped and rotatable Tuniu API key, and require a clear final confirmation with hotel, room, dates, price, guest names, and phone number before any order is submitted.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:36
Finding

Configurable MCP endpoint can disclose API credentials and booking PII

Content
View full analysis
","roomId":"","preBookParam":"","checkInDate":"","checkOutDate":"","roomCount":1,"roomGuests":[{"guests":[{"firstName":"","lastName":""}]}],"contactName":"","contactPhone":""}}}' ``` The same configurable destination is used by the search and hotel-detail requests at lines 62–101. ### Technical Analysis The Skill sends the `TUNIU_API_KEY` in an HTTP request header to the value of `TUNIU_MCP_URL`. For order creation, it also sends guest names, the contact name, phone number, travel dates, hotel and room identifiers, and booking parameters. The default destination is the official HTTPS Tuniu endpoint, and transmitting the booking information to that endpoint is necessary for the declared booking functionality. However, the optional endpoint override is not constrained by scheme, hostname, port, or path. It can therefore designate an unrelated HTTPS host, a plaintext HTTP endpoint, or a local network service. This behavior exceeds the minimum privileges required by the Skill: ordinary operation only requires access to the official Tuniu hotel endpoint. Pe ...[truncated 1359 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:50
Finding

User-controlled values are interpolated into shell command templates without safe serialization

Content
View full analysis
","checkIn":"","checkOut":""}}}' ``` ```bash curl -s -X POST "${TUNIU_MCP_URL:-https://openapi.tuniu.cn/mcp/hotel}" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "apiKey: $TUNIU_API_KEY" \ -d '{"jsonrpc":"2.0","id":5,"method":"tools/call","params":{"name":"tuniuHotelDetail","arguments":{"hotelName":"","checkIn":"","checkOut":""}}}' ``` ```bash curl -s -X POST "${TUNIU_MCP_URL:-https://openapi.tuniu.cn/mcp/hotel}" \ -H "Content-Type: application/json" \ -H "Accept: application/json, text/event-stream" \ -H "apiKey: $TUNIU_API_KEY" \ -d '{"jsonrpc":"2.0","id":6,"method":"tools/call","params":{"name":"tuniuHotelCreateOrder","arguments":{"hotelId":"","roomId":"","preBookParam":"","checkInDate":"","checkOutDate":"","roomCount":1,"roomGuests":[{"guests": ...[truncated 2530 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

External Transmission

Medium
Category
Data Exfiltration
Confidence
60% confidence
Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: tuniu-hotel
description: 途牛酒店助手 - 通过 exec + curl 调用 MCP 实现酒店搜索、详情查询、预订下单。适用于用户询问某地酒店、入住日期、查看酒店详情或提交订单时使用。
version: 1.0.4
metadata: {"openclaw": {"emoji": "🏨", "category": "travel", "tags": ["途牛", "酒店", "预订", "搜索"], "requires": {"bins": ["curl"]}, "env": {"TUNIU_API_KEY": {"type": "string", "description": "途牛开放平台 API key，用于 apiKey 请求头", "required": true}}}}
---

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The hotel-search activation phrases are broad enough that ordinary travel conversation could trigger external tool use without a clear, explicit invocation boundary. In this skill, that means user travel details such as city and dates may be sent to a third-party MCP service earlier than intended, increasing privacy and unintended-action risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The order-creation trigger phrases are vague and include common language like '订这个' or '我要订', which can cause a booking action to fire without a strong confirmation boundary. Because this operation transmits PII and creates a real order, ambiguous triggering materially raises the risk of unintended transactions and privacy exposure.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.