T08 · Insecure Dependencies
Warning
- Location
SKILL.md:27- Finding
Automatic Installation and Execution of an Unpinned npm Package
- Content
View full analysis
- Remediation
View remediation
Security audit
途牛旅游CLI技能
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed travel-booking assistant, but it asks agents to automatically install mutable npm packages and update local agent skill directories, which users should review before installing.
Install only if you are comfortable with an agent installing or updating tuniu-cli from npm and writing/updating local skill directories. Prefer preinstalling a reviewed, pinned CLI version yourself, use a protected secret store for TUNIU_API_KEY, and confirm before any booking call that sends passenger or contact information to Tuniu.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (7)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill authorizes modifying shell startup files and local config files to persist API keys, which gives a travel assistant unnecessary access to the user's local environment and secrets handling. Even with cautions about masking, this can leak credentials into files, command history, logs, backups, or unintended contexts, and it normalizes privileged local state changes unrelated to the core business function.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to automatically install or update
tuniu-clivianpm install -g, expanding its behavior from travel operations into software management and arbitrary code execution. Installing packages from a registry at runtime introduces unnecessary supply-chain and privilege risks, especially when the skill's primary purpose is only to call travel services.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
The skill recommends executing
npx tuniu-cliwithout a pinned version, which causes code to be fetched and run from the package registry at invocation time. This creates a supply-chain risk: a compromised or newly published package version could execute unexpected code in the agent environment.- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill includes commands to install or update skills into agent directories, which broadens its authority from travel-service usage to modifying agent configuration and code placement. This creates persistence and trust-boundary concerns because a skill can influence other agents or future sessions by changing installed skill state.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The skill recommends executing
npx tuniu-cli --versionwithout pinning a specific package version. This allows retrieval of whatever version is currently published, increasing supply-chain risk if a malicious or compromised package version is pushed upstream and then executed automatically in the user's environment.- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 1. **不要明文复述密钥**：API Key 只能用脱敏形式确认，例如 `tn_****abcd`，不得在回复、业务参数、日志摘要、调试输出中明文展示完整密钥。 2. **优先持久化到环境变量**：如果 Agent 有权限修改用户 shell 配置，征得用户同意后，将 `export TUNIU_API_KEY=...` 写入用户当前 shell 的启动文件（如 `~/.zshrc`、`~/.bashrc`、`~/.profile`），并提醒用户重新打开终端或执行 `source <文件>`。写入时不得把完整密钥打印到终端输出；若当前 Agent 会记录完整 shell 命令，不要代替用户执行包含真实密钥的命令；应提示用户在本地终端自行设置环境变量。 3. **无持久化权限时使用临时环境变量**：只能在当前会话中设置 `TUNIU_API_KEY`，并明确说明重启终端或 Agent 后可能需要重新配置。 4. **配置文件仅作兜底**：若无法设置环境变量，且用户明确同意把密钥写入本地文件，可初始化 `~/.tuniu-mcp/config.json` 并把各服务 `headers.apiKey` 从 `${TUNIU_API_KEY}` 改为实际密钥，同时将文件权限设为仅当前用户可读写（例如 `chmod 600 ~/.tuniu-mcp/config.json`）。 5. **优先使用宿主 Agent 的密钥/Secret 能力**：如果运行环境提供 Secret 管理、凭证输入框或受保护环境变量，应优先使用该能力，避免把密钥写入聊天记录或 shell 历史。 ## 速查表
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 80% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
md 1. **不要明文复述密钥**：API Key 只能用脱敏形式确认，例如 `tn_****abcd`，不得在回复、业务参数、日志摘要、调试输出中明文展示完整密钥。 2. **优先持久化到环境变量**：如果 Agent 有权限修改用户 shell 配置，征得用户同意后，将 `export TUNIU_API_KEY=...` 写入用户当前 shell 的启动文件（如 `~/.zshrc`、`~/.bashrc`、`~/.profile`），并提醒用户重新打开终端或执行 `source <文件>`。写入时不得把完整密钥打印到终端输出；若当前 Agent 会记录完整 shell 命令，不要代替用户执行包含真实密钥的命令；应提示用户在本地终端自行设置环境变量。 3. **无持久化权限时使用临时环境变量**：只能在当前会话中设置 `TUNIU_API_KEY`，并明确说明重启终端或 Agent 后可能需要重新配置。 4. **配置文件仅作兜底**：若无法设置环境变量，且用户明确同意把密钥写入本地文件，可初始化 `~/.tuniu-mcp/config.json` 并把各服务 `headers.apiKey` 从 `${TUNIU_API_KEY}` 改为实际密钥，同时将文件权限设为仅当前用户可读写（例如 `chmod 600 ~/.tuniu-mcp/config.json`）。 5. **优先使用宿主 Agent 的密钥/Secret 能力**：如果运行环境提供 Secret 管理、凭证输入框或受保护环境变量，应优先使用该能力，避免把密钥写入聊天记录或 shell 历史。 ## 速查表
Static analysis
No suspicious patterns detected.