ClawHub
Back to skill

Security audit

LovTrip Content Browser

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is mostly coherent, but it recommends running an unpinned npm CLI through npx for simple read-only queries, which gives changing third-party code local execution ability.

Review before installing or using. Prefer the documented `curl` HTTPS API examples over the CLI. If the CLI is necessary, use a pinned, reviewed `lovtrip` version in a sandbox with minimal local file and credential access, and avoid sending sensitive personal itinerary details in search queries.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Error
Location
SKILL.md:20
Finding

Unpinned npm Package Download and Execution via npx

Content
View full analysis

Vulnerability Details

File Location: SKILL.md:20,34-35,47-48,62,74-75,87-88; examples/search-guides.md:6,29,36,43
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: High

Vulnerable Code

SKILL.md:20:

bash
npx lovtrip@latest --help

SKILL.md:34-35:

bash
npx lovtrip search "京都3天"
npx lovtrip search "Bali beach" --json

SKILL.md:47-48:

bash
npx lovtrip guides
npx lovtrip guides --destination "Tokyo"

SKILL.md:62:

bash
npx lovtrip guide kyoto-3-day-food-tour

SKILL.md:74-75:

bash
npx lovtrip destinations
npx lovtrip destinations --trending

SKILL.md:87-88:

bash
npx lovtrip itineraries
npx lovtrip itineraries --destination "Bali" --days 5

examples/search-guides.md:6,29,36,43:

bash
npx lovtrip search "京都"
npx lovtrip destinations --trending
npx lovtrip guide kyoto-3-day-classic
npx lovtrip search "Bali" --json | python3 -c "
import json, sys
data = json.load(sys.stdin)
for item in data.get('results', []):
    print(f\"- {item['title']}: {item.get('url', 'N/A')}\")
"

Technical Analysis

The documented commands instruct users or agents to run the lovtrip npm package through npx. The explicit @latest selector and commands that omit a version allow npm to retrieve and execute whatever package release is current when the command runs. Consequently, the effective executable code can change after this Skill has been reviewed.

npx may download the package and its dependency tree, then execute package CLI code and applicable installation lifecycle behavior. This creates a supply-chain trust boundary that is not constrained by an exact reviewed version or integrity value. A compromised publisher account, malicious release, dependency compromise, or npm distribution-chain incident could therefore turn an apparently legitimate travel query into arbitrary loc ...[truncated 1784 chars]

Remediation
View remediation

Remediation Suggestions

  1. Prefer the documented direct HTTPS API for all travel-content queries because it fulfills the declared functionality without locally executing an npm package.
  2. If the CLI is required, pin it to an exact version rather than using @latest or an omitted version:
    bash
    npx --yes lovtrip@X.Y.Z --help
  3. Review the pinned release, its dependency tree, package metadata, lifecycle scripts, and published artifacts before approving it.
  4. Use a lockfile and verified integrity metadata when installing the CLI as part of a controlled project environment.
  5. Disable package lifecycle scripts where operationally possible, and verify that the CLI remains functional under that restriction.
  6. Run the CLI in a sandbox with read-only project access, no unnecessary credentials, minimal environment variables, and network access restricted to required LovTrip endpoints.
  7. Replace silent curl -s examples with failure-aware requests such as curl --fail --silent --show-error, and URL-encode user-controlled query values for reliability and input safety.
  8. Document the npm registry and package publisher that users are expected to trust, along with a controlled process for reviewing and upgrading the pinned version.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (30)

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
无需任何 API Key 或环境变量。

### 方式 2: curl

直接调用 LovTrip 公开 API，无需安装任何工具。

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md
无需任何 API Key 或环境变量。

### 方式 2: curl

直接调用 LovTrip 公开 API,无需安装任何工具。

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/guides?limit=10" | python3 -m json.tool
curl -s "https://lovtrip.app/api/guides?destination=Tokyo&limit=10" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 57)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/guides?limit=10" | python3 -m json.tool
curl -s "https://lovtrip.app/api/guides?destination=Tokyo&limit=10" | python3 -m json.tool

3. 攻略详情 — guide

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 71)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/guides/kyoto-3-day-food-tour" | python3 -m json.tool

4. 目的地 — destinations

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/destinations?limit=20" | python3 -m json.tool
curl -s "https://lovtrip.app/api/destinations/trending" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/itineraries?limit=10" | python3 -m json.tool
curl -s "https://lovtrip.app/api/itineraries?destination=Bali&days=5" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 103)May include surrounding context.

curl:

bash
curl -s "https://lovtrip.app/api/itineraries?limit=10" | python3 -m json.tool
curl -s "https://lovtrip.app/api/itineraries?destination=Bali&days=5" | python3 -m json.tool

CLI 全局选项

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples/search-guides.md (reported line 55)May include surrounding context.

"

text

## 场景 5: curl 直接调用

```bash
# 搜索

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md
curl -s "https://lovtrip.app/api/search?q=东京美食" | python3 -m json.tool

# 热门目的地
curl -s "https://lovtrip.app/api/destinations/trending" | python3 -m json.tool

# 按目的地筛选攻略
curl -s "https://lovtrip.app/api/guides?destination=Tokyo&limit=5" | python3 -m json.tool

External Script Fetching

High
Category
Supply Chain
Confidence
90% confidence
Finding

Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Content

Scanner excerpt · examples/search-guides.md (reported line 62)May include surrounding context.

md
curl -s "https://lovtrip.app/api/search?q=东京美食" | python3 -m json.tool

# 热门目的地
curl -s "https://lovtrip.app/api/destinations/trending" | python3 -m json.tool

# 按目的地筛选攻略
curl -s "https://lovtrip.app/api/guides?destination=Tokyo&limit=5" | python3 -m json.tool

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill encourages networked searches against a third-party API/CLI but does not explicitly warn that user queries will be transmitted externally. This can lead to unintended disclosure of personal travel plans, locations, names, or other sensitive itinerary details to the external service.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The setup command uses npx lovtrip@latest, which pulls and executes whatever package version is current at runtime. This creates a supply-chain execution risk: if the package is compromised, typosquatted, or a bad update is published, users of the skill may run attacker-controlled code on their machine.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This invocation tells users to execute npx lovtrip search ... without a pinned version, so the resolved package can change over time. Because npx downloads and runs code, an upstream compromise could turn a simple search action into arbitrary code execution on the host.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The JSON example also executes npx lovtrip without version pinning, preserving the same package-substitution and malicious-update risk. The fact that it is a common example increases exposure because users are likely to copy/paste it directly.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This guide-listing command relies on unpinned npx execution of a remote npm package. Any future package takeover or malicious publish would execute code with the user's privileges when following the skill instructions.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The destination-filtered guides example still executes an unversioned package fetched at runtime. That makes the skill brittle and vulnerable to dependency compromise outside the user's control.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

Viewing a guide via npx lovtrip guide ... requires executing unpinned remote code. In the context of a skill intended for broad copy/paste use, this is a meaningful supply-chain risk rather than a theoretical issue.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The destinations example invokes an unpinned npm package through npx, exposing users to arbitrary code execution if the package or its resolution path is compromised. This risk is amplified by the skill's framing as a simple no-key workflow, which may lower user caution.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The trending destinations command repeats the same unpinned runtime package execution pattern. Users following it may unknowingly run changed code at any future date.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The itineraries listing example uses unpinned npx execution, which is a classic software supply-chain weakness. A compromised package can perform far more than the advertised network query, including reading local files or spawning additional processes.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

This destination-specific itinerary command again depends on a mutable package reference. The vulnerability is consistent across all npx lovtrip examples because the dangerous property is runtime execution of unreviewed current package contents.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The example user flow includes npx lovtrip search without version pinning, which normalizes unsafe execution practices. Because examples are likely to be reused verbatim, this materially increases the chance of exploitation via package compromise.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
95% confidence
Finding

The follow-up example for fetching guide details again uses unpinned npx execution. This exposes hosts to arbitrary code from the npm ecosystem for what should be a simple content retrieval operation.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.