ClawHub
Back to skill

Security audit

Flight Search

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward flight-search helper that reads its bundled city-code table and contacts Ctrip for one-way flight results.

Install this if you are comfortable with the agent running a bundled Python script that sends the requested route and date to Ctrip for live flight results. It does not appear to access credentials, modify files, or persist behavior, but its output and city-name support are oriented toward Chinese-language use.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Content
- Treat this as one-way search only unless the skill is explicitly extended.
- If the requested date is in the past, stop and tell the user.

## Output Rules

- Sort results by price from low to high.
- Prefer concise Chinese output that reads cleanly in Telegram.
Confidence
85% confidence
Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Lp3

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding
The skill invokes a bundled Python script and references local resources, which implies network access and file reads, yet the manifest declares no explicit tool scope or permissions. This creates an authorization gap where the runtime may grant broader capabilities than reviewers or policy engines expect, increasing the risk of unintended data access or outbound requests.

Natural-Language Policy Violations

Medium
Confidence
95% confidence
Finding
The instruction 'Prefer concise Chinese output' imposes a language preference in the skill behavior, but the document does not indicate that the user can choose another language or opt in to Chinese output. This matches the language/locale policy violation category because it sets a default language constraint in natural-language instructions.

Natural-Language Policy Violations

Medium
Confidence
88% confidence
Finding
This JSON file defines all location keys in Chinese only, which can impose a specific language/locale on downstream users or agents. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation, and the file contains no indication that this locale restriction is optional or justified.

Static analysis

No suspicious patterns detected.