智能旅游记录

• Outcome: Pass
• Latest audit: May 28, 2026 · 2:14 PM UTC
• Version: 1.0.0

Overview

This is a local travel-journal skill with expected privacy and data-loss risks, but no evidence of hidden exfiltration, credential access, or malicious behavior.

Install only if you are comfortable with a local journal that saves travel messages, uploaded media, timestamps, locations, and possible EXIF metadata. Start and end trips deliberately, confirm any delete or export request, and review HTML/PDF/Markdown exports before sharing because they may include identifying travel details or unsafe embedded HTML from notes.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill performs local file read/write operations and stores uploaded media, but it does not declare any permissions or capability boundaries. This creates a transparency and governance gap: the platform or user may not realize the skill can persist files locally, increasing the risk of unintended data access, retention, or misuse if the runtime trusts undeclared behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 84% confidence
• Finding: The documented purpose presents the skill as a travelogue recorder/exporter, but the behavior includes broader record enumeration, fuzzy lookup, mutation, and deletion operations that are not clearly disclosed. Hidden or under-documented destructive and bulk-access capabilities can lead to accidental data loss or over-collection because users and orchestration logic may invoke the skill under incomplete assumptions.

Description-Behavior Mismatch

Medium

• Confidence: 88% confidence
• Finding: The code exposes a delete capability that permanently removes trips and associated moments, but the skill metadata and triggers only describe starting/ending trips, recording content, generating travelogues, and exporting files. In an agent context, extra destructive functionality outside the declared scope increases the risk of unintended or unauthorized data loss if the model or orchestration invokes it incorrectly.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The trigger set is broad enough that ordinary travel-related conversation could activate the skill and cause stateful actions such as creating records, attaching messages as trip content, or exporting data. In a skill that stores user content and files, unintended activation increases privacy risk and can corrupt records through accidental ingestion.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The start-trip examples and keywords are ambiguous, especially because generic words like '记录' can appear in normal conversation unrelated to opening a new travel archive. This can cause the skill to create a new ongoing trip unexpectedly, after which later user messages may be automatically recorded as material.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: End-trip triggers include everyday phrases like '回家了', which may occur in casual conversation without meaning 'finalize and stop recording this archive'. Because ending a trip changes lifecycle state and blocks future additions unless the user uses a special supplement flow, accidental activation can prematurely close records and disrupt data integrity.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The export spec explicitly encourages including EXIF-derived capture time and location text in exported travelogue content, which can reveal sensitive privacy details such as where and when a user was present. In a travel-recording skill, this is especially risky because the data directly maps to user movements and habits, and the document provides no warning, consent step, or stripping guidance.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The metadata section embeds author, creation date, trip_id, and aggregate trip details directly into exported files without any privacy notice or minimization guidance. These fields can identify a user, correlate exports across systems, and expose travel patterns if the file is shared publicly or leaked.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The template uses Jinja's safe rendering for content, which disables escaping and can allow untrusted HTML to be injected into the generated export. If user-provided travel notes or imported material are rendered this way, the resulting HTML may contain active scripts or dangerous markup, creating stored XSS in exported HTML and potentially unsafe content paths into PDF/HTML rendering pipelines.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: delete_trip() performs irreversible deletion of a trip and related moments immediately upon receiving a trip ID, with no confirmation step, warning, undo, or transactional safeguard. In a natural-language agent workflow, this is dangerous because a mistaken tool call, ambiguous user request, or prompt-manipulated action could silently destroy user data.

Static analysis

No suspicious patterns detected.