T09 · Insecure Skill Coding Practices
Error
- Location
src/crawler/ota-crawler.js:135- Finding
Weak URL Validation Enables Server-Side Request Forgery and Unsafe Browser Navigation
- Content
View full analysis
- Remediation
View remediation
Security audit
Tour Compare
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent travel comparison tool, but its link-crawling and install flow give it more network and local execution authority than its documentation safely scopes.
Install only after reviewing the crawler and dependency setup. Prefer JSON input or --no-fetch, avoid sensitive screenshots, run dependency installation explicitly in an isolated environment, and do not feed untrusted or crafted URLs until strict hostname validation, redirect checks, private-network blocking, and Chromium sandboxing are fixed.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T08 · Insecure Dependencies
Warning
- Location
scripts/compare.sh:11- Finding
Automatic Dependency Installation Executes Lifecycle Scripts from a Nonstandard Registry
- Content
View full analysis
=6.9.0" } }, "node_modules/@babel/helper-validator-identifier": { "version": "7.28.5", "resolved": "https://registry.anpm.alibaba-inc.com/@babel/helper-validator-identifier/-/helper-validator-identifier-7.28.5.tgz", "integrity": "sha512-qSs4ifwzKJSV39ucNjsvc6WVHs6b7S03sOh2OcHF9UHfVPqWWALUsNUVzhSBiItjRZoLHx7nIarVjqKVusUZ1Q==", "dev": true, "license": "MIT", "engines": { "node": ">=6.9.0" } }, "node_modules/@puppeteer/browsers": { "version": "2.3.0", "resolved": "https://registry.anpm.alibaba-inc.com/@puppeteer/browsers/-/browsers-2.3.0.tgz", ``` Puppeteer is also marked as having an installation script: ```json "node_modules/puppeteer": { "version": "22.15.0", "resolved": "https://registry.anpm.alibaba-inc.com/puppeteer/-/puppeteer-22.15.0.tgz", "integrity": "sha512-XjCY1SiSEi1T7iSYuxS82ft85kwDJUS7wj1Z0eGVXKdtr5g4xnVcbjwxhq5xBnpK/E7x1VZZoJDxpjAOasHT4Q==", "deprecated": "< 24.15.0 is no longer supported", "dev": true, "hasInstallScript": true, "license": "Apache-2.0", "dependencies": { ...[truncated 2719 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (61)
Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The lockfile pins basic-ftp 5.2.0, and the package is present transitively through get-uri/pac-proxy-agent/proxy-agent used by Puppeteer tooling. If this dependency processes attacker-controlled FTP URLs or server responses, the cited command-injection and DoS issues could be exploitable. In this file it is only a dependency manifest, so the risk depends on whether the application actually exercises that code path.
- Content
Known Vulnerable Dependency: extract-zip==2.0.1 — 2 advisory(ies): CVE-2026-19693 (extract-zip allows arbitrary file writes through symlink archive entries); CVE-2026-56876 (extract-zip unvalidated symlink path traversal)
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
extract-zip 2.0.1 is included as a transitive dependency of @puppeteer/browsers and is associated with symlink/path traversal arbitrary-write issues during archive extraction. Because Puppeteer commonly downloads and extracts browser archives during install or tooling operations, this can become dangerous if the archive source or cache is attacker-influenced.
- Content
Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)
High
- Category
- Supply Chain
- Confidence
- 80% confidence
- Finding
ip-address 10.1.0 appears as a transitive dependency of socks-related proxy handling. The listed issues are real package-level concerns, but in this project context they are likely only reachable if the application uses proxy parsing or renders attacker-controlled IPv6 HTML output, which is not evident from the lockfile alone.
- Content
Known Vulnerable Dependency: js-yaml==4.1.1 — 4 advisory(ies): CVE-2026-84375 (js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources); CVE-2026-59869 (js-yaml: YAML merge-key chains can force quadratic CPU consumption); GHSA-5p4m-2wfm-xmqj (JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026) +1 more
High
- Category
- Supply Chain
- Confidence
- 87% confidence
- Finding
js-yaml 4.1.1 is present transitively through cosmiconfig used by Puppeteer. The advisories describe CPU exhaustion during YAML parsing; this is a genuine dependency risk, but exploitability depends on parsing attacker-controlled YAML, which is not established by the lockfile alone and is less likely in a typical local tooling context.
- Content
Known Vulnerable Dependency: undici==7.24.6 — 12 advisory(ies): CVE-2026-6733 (undici vulnerable to HTTP response queue poisoning via keep-alive socket reuse); CVE-2026-13697 (undici vulnerable to cross-user information disclosure and parse-time crash via ); CVE-2026-16728 (undici vulnerable to downstream response desynchronization via retry interceptor) +9 more
High
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
undici 7.24.6 is bundled through Cheerio and has multiple HTTP parsing and desynchronization advisories. If this project fetches attacker-controlled or untrusted remote content using the affected code paths, the impact can include request/response confusion, information disclosure, or denial of service; the presence of network-fetching libraries in the project makes this more relevant than a purely dormant dependency.
- Content
Known Vulnerable Dependency: ws==8.20.0 — 2 advisory(ies): CVE-2026-45736 (ws: Uninitialized memory disclosure); CVE-2026-48779 (ws: Memory exhaustion DoS from tiny fragments and data chunks)
High
- Category
- Supply Chain
- Confidence
- 82% confidence
- Finding
ws 8.20.0 is present via puppeteer-core and is reported vulnerable to memory disclosure and memory exhaustion. In this skill context it is probably used for browser automation transport rather than public WebSocket exposure, which reduces but does not eliminate risk, especially in shared CI or automation environments handling untrusted endpoints.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The changelog introduces direct URL scraping of third-party OTA product pages and explains how to pass external URLs into the tool, but it does not clearly warn users that this feature initiates outbound network requests and retrieves remote content. In an agent skill context, undocumented external access can surprise users, violate least-astonishment expectations, and expand the attack surface through untrusted remote pages, tracking, or policy-sensitive data flows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
This markdown file documents a Puppeteer-based crawler that fetches product data from external OTA URLs, including batch crawling, but it does not warn users that using the feature will initiate network requests to third-party sites. For markdown files, safety-relevant behaviors affecting privacy or system/network activity should be disclosed clearly to users.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The feature summary promotes URL crawling and OCR-based screenshot processing but does not warn users that supplying links or images may transmit external content, extract potentially sensitive data, or trigger requests to third-party sites. In an agent skill context, this omission can mislead users into sharing booking links or screenshots containing personal information, creating privacy and consent risks even if the functionality itself is not inherently malicious.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
该快速入门全文以中文编写，并在示例与说明中默认使用中文界面与术语，但没有说明这是面向特定中文用户群的限定文档，也没有提供语言选择。根据 SQP-3，若技能在自然语言层面强制特定语言而无用户选择或明确合理化，属于语言/locale 策略风险。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The natural-language documentation appears to require Chinese for all user interaction and instructions, but there is no opt-in language selection or justification that this skill is intentionally restricted to Chinese users. Per the policy, forcing a specific language without user choice is a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The file consistently presents the skill as operating in Chinese, including the title, trigger phrases, examples, and user-facing outputs, but does not state that this is optional or provide a user language choice. Because the policy requires avoiding forced language or locale constraints without opt-in or justification, this constitutes a natural-language policy concern.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The listed triggers include generic phrases like “哪个更好”, “推荐”, and “帮我选” combined with broad travel terms, which are common in ordinary conversation and may cause the skill to activate when the user is not explicitly asking for comparative analysis. The document does not provide exclusion conditions or clear boundaries distinguishing this skill from general travel recommendation behavior.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The example returns a full host-local file URI (
file:///Users/...) to the user, which leaks internal filesystem structure and the local username. Such disclosures aid environment fingerprinting and can expose sensitive host details that should remain hidden from end users.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This repeated example again instructs the assistant to disclose a host-local report path. Repetition makes the behavior more likely to be implemented consistently, increasing the chance of routine leakage of workstation usernames, directory layout, and runtime environment details.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Another file URI leak reveals internal path information through user-facing output. In this skill context, generating local HTML reports makes the issue more dangerous because it normalizes exposing host-generated artifacts and platform details to users across multiple workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The guide explicitly recommends users send screenshots directly in chat for OCR processing, but it does not warn that screenshots may contain sensitive personal information such as names, booking details, contact data, or other on-screen content. This creates a real privacy risk because users may disclose more data than necessary without informed consent or minimization guidance.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The documentation instructs users to run
npx clawhubwithout pinning an exact package version, which can cause execution of whatever version is current at install time. If the upstream package is compromised, typo-squatted, or a breaking release is published, users may execute unreviewed code during login or publish operations.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command combines an unpinned
npx clawhubinvocation with API token usage, increasing the risk because any malicious or unexpected package version would run in a context where sensitive credentials are being provided. A compromised package could capture the token or misuse it to publish or modify assets.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
Publishing with
npx clawhub publishwithout version pinning means the command fetches and runs a potentially changing remote package at release time. This introduces supply-chain risk and can lead to execution of malicious code or altered publish behavior in a sensitive workflow.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 94% confidence
- Finding
The release update instructions again rely on an unpinned
npxpackage execution, exposing maintainers to upstream package changes or compromise. Because this step is part of recurring release operations, it creates repeated opportunities for supply-chain abuse.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 93% confidence
- Finding
The tagging example uses
npx clawhub publishwithout pinning, which still executes remote package code dynamically. Even though this is only an example, users commonly copy-paste documentation commands directly, so the risk is practical rather than theoretical.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 92% confidence
- Finding
The troubleshooting advice tells users to run
npx clawhub loginwithout a fixed version, which preserves the same supply-chain execution risk as the main workflow. In a support context, users may be especially likely to run the command quickly without additional verification.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The usage guide encourages URL-based inputs and 'automatic fetch + compare' behavior but does not clearly warn that external links will be accessed over the network. This can lead to unexpected outbound requests, privacy issues, or SSRF-like behavior if the surrounding system permits fetching arbitrary user-supplied URLs.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The conversation examples describe broad natural-language requests that could trigger the skill during ordinary chat without clear activation boundaries or confirmation steps. In an agent environment, this increases the chance of unintended invocation and can cascade into network fetching or analysis of URLs the user did not explicitly intend the skill to access.
- Content
Static analysis
No suspicious patterns detected.