T01 · Skill Instruction Hijacking
Error
- Location
scripts/lib/query-response.js:75- Finding
Forced Reproduction of Commercial Links and Promotional Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Tongcheng Chengxin Travel Search
Security checks for vulnerabilities and agentic risk
Overview
This travel-search skill is mostly coherent, but it should be reviewed because it can force unfiltered commercial links and remote user content into agent responses.
Review before installing. Use it only if you are comfortable sending travel queries to the disclosed Chengxin API and receiving booking links in responses. Prefer storing the API key in the platform environment setting instead of a local config.json file, and treat returned links and user-generated travel content as untrusted until verified.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/formatters.js:14- Finding
API-Controlled URLs Are Rendered Without Scheme or Domain Validation
- Content
View full analysis
0) { output += ` 🏞️ 涉及景区：${scenery_list.join('、')}\n`; } if (topic) { output += ` 🏷️ 话题：${topic}\n`; } if (content_summary) { output += ` 📄 内容摘要：${content_summary}\n`; } output += ` 🔗 [查看全文](${redirect_url})\n\n`; ``` ### Technical Analysis `is_valid_booking_url()` only rejects null values, empty strings, and the literal placeholder `#`. It does not: - Parse the value as a URL. - Require the `https:` scheme. - Reject unsafe or unexpected URI schemes. - Restrict destinations to the documented `ly.com` or `17u.cn` domains. - Escape M ...[truncated 1801 chars]- Remediation
View remediation
T01 · Skill Instruction Hijacking
Warning
- Location
scripts/travel-query.js:204- Finding
Untrusted Remote UGC Is Reproduced Without Content Sanitization
- Content
View full analysis
{ const name = ugc.name || '无标题'; const author = ugc.nickName || '匿名用户'; const city_name = ugc.cityName || ''; const scenery_list = (ugc.sceneryNameList || []).filter(s => s && s !== '-'); const topic = ugc.topic || ''; const raw_content = ugc.ugcContent || ''; const content_summary = raw_content.length > CONTENT_SUMMARY_LIMIT ? raw_content.substring(0, CONTENT_SUMMARY_LIMIT) + '…' : raw_content; const redirect_url = ugc.redirectUrl || '#'; output += `${idx + 1}. **${name}** - ${author}\n`; if (city_name) { output += ` 📍 城市：${city_name}\n`; } if (scenery_list.length > 0) { output += ` 🏞️ 涉及景区：${scenery_list.join('、')}\n`; } if (topic) { output += ` 🏷️ 话题：${topic}\n`; } if (content_summary) { output += ` 📄 内容摘要：${content_summary}\n`; } output += ` 🔗 [查看全文](${redirect_url})\n\n`; }); output += '💡 以上攻略由真实用户分享，以下内容可作为你制定行程的参考。\n\n'; return output; } ``` ### Technical Analysis The formatter treats API-delivered UGC fields as trusted display content. The title, author, city, scenery names, topic, article body, and redirect URL are inserted directly into Markdown. The only control applied to `ugcContent` is a 2,000-character length limit. Length truncation does not prevent content injection. A malicious UGC record can con ...[truncated 1831 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (46)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
The description claims a general-purpose travel search skill spanning many travel verticals and booking-related scenarios. However, the provided code chunk is narrowly scoped to 景点/景区查询: it validates only a destination, calls a fixed scenery API path, and formats scenery results. There is no evidence in this chunk of flight, rail, hotel, vacation,攻略,行程规划,汽车票, or ticket-booking navigation logic. This is a material description-versus-behavior mismatch because the actual primary purpose of the code shown is much narrower than the declared purpose.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 92% confidence
- Finding
代码的主功能与声明存在明显范围不一致。该代码块专注于交通资源智能查询：校验出发地/目的地参数，调用交通接口，并输出火车、机票、汽车票和公交地铁路线结果。这与声明中大范围的旅游服务能力相比明显更窄。虽然声明中包含机票、火车票、汽车票等内容，与代码部分吻合，但代码没有展示酒店、度假产品、攻略、行程规划、景区、门票等核心能力，因此若将该代码块视为该技能实际实现，则描述夸大了已实现功能范围。未见明显恶意或越权行为；不匹配主要体现在声明远超代码实际能力。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
该代码块的主要目的与描述存在明显范围不一致。描述将技能定位为覆盖多种旅游品类的通用旅游搜索能力，而实际代码明确标注为“火车票专用查询 API”，只操作单一 TRAIN_API_PATH（/trainResource），并围绕火车票查询参数验证、结果格式化和往返/中转展示展开。虽然“火车票查询”属于声明范围的一个子集，但当前提供的代码并不能支撑描述中的广泛能力，因此描述对该代码块代表的能力有明显夸大，构成不匹配。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如对查询文本中的个人信息有顾虑，请避免输入敏感信息，或直接查看 `scripts/lib/api-client.js`（网络调用）和 `scripts/lib/query-response.js`（响应处理）以确认数据流向。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
The description is entirely in Chinese and presents the skill as a general travel assistant, but nowhere indicates that the skill is limited to Chinese-language use or that users may choose another language. Under the policy, a skill that effectively imposes a specific language without opt-in can be a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The documentation explicitly recommends storing an API key in a local
config.jsonfile in plaintext, but does not warn about file permission restrictions, accidental source control commits, backups, or local disclosure. While this is a common convenience pattern, it increases the chance that long-lived credentials are exposed through repository commits, shared folders, logs, or compromised endpoints.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The file mandates that the model "must" show a fixed Chinese error-handling message to users, and all prescribed user-facing text is only in Chinese. There is no opt-in, alternative locale, or documented justification that this skill is restricted to Chinese-speaking users, which conflicts with language-choice policy expectations.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrase '用 tc-chengxin 技能查询 XXX' is overly broad and may cause the skill to be invoked whenever similar natural-language text appears, including quoted text or indirect discussion rather than an explicit user request. In an agent setting, broad invocation rules increase the chance of unintended tool use, which can lead to unnecessary external API calls, confusing behavior, or disclosure of user queries to the third-party travel service.
- Content
Static analysis
No suspicious patterns detected.