Security audit
途牛旅游CLI技能
Security checks for vulnerabilities and agentic risk
Overview
This travel assistant is purpose-aligned and disclosed, but users should be careful because it can install a CLI, use an API key, send traveler personal data to Tuniu, and create travel orders.
Install only if you trust the Tuniu CLI/package and intend to use Tuniu travel services. Use a protected secret or environment variable for TUNIU_API_KEY, avoid pasting full credentials into chat, and confirm every booking or cancellation before letting the agent run an order command.
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Static analysis
No suspicious patterns detected.