Security audit

猫眼电影票购票助手

Security checks across malware telemetry and agentic risk

Overview

This movie-ticket skill matches its stated purpose, but it gives the agent purchase/session authority and uses ready-to-run messaging commands for login and payment links that need careful review.

Review before installing. Use this only if you trust the publisher and are comfortable with the skill storing a short-lived Maoyan session token, sharing location/account data with Maoyan, locking seats by creating orders, and sending login or payment QR links through the current chat channel. Confirm the recipient and purchase details yourself before proceeding.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (17)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The script constructs a ready-to-run `openclaw message send` command using `channel` and `targetId` from input context, enabling outbound messaging to an arbitrary destination. In a ticket-booking skill, sending login/payment QR codes may be functionally related, but returning a directly executable command for message delivery expands the skill into cross-channel message dispatch and can be abused for unsolicited messages, phishing-style prompts, or delivery to the wrong recipient if context is manipulated.

Intent-Code Divergence

Low

Confidence: 82% confidence
Finding: Although the comment says the script no longer executes shell commands directly, it still assembles a fully executable shell command string containing untrusted context values and message content. This is dangerous because downstream components may execute the string as-is, reintroducing command-injection and unsafe-command-execution risk through an indirect path.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The top-level trigger phrases are broad enough to match casual movie-related conversation such as wanting recommendations or asking what is showing, yet the skill is designed to proceed through a full ticket-purchase workflow. In a transactional skill that can guide login, seat selection, and payment, overbroad activation increases the chance of unintended invocation and socially engineering users into a purchase flow they did not explicitly request.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: Capability 1 explicitly states that vague intent should default into the booking flow and even says not to ask for city first, which encourages the agent to steer exploratory conversation into a transaction-oriented process. In context, this is more dangerous because the same skill later handles authentication, order creation, and payment links, so ambiguity at the front door can cascade into sensitive actions.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The document defines an API that requires precise latitude and longitude to find nearby cinemas, but it provides no guidance to obtain explicit user consent, minimize retention, or explain how location data is used. In a ticket-booking skill, precise location is sensitive personal data, and silent collection or transmission could expose user privacy or violate platform expectations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill supports loading, validating, saving, and clearing a local AuthKey without any warning about the security sensitivity of the token or the account access it grants. Because this is a movie-ticket purchasing workflow, a stored AuthKey may enable account takeover-like effects within the service, including viewing account data, placing orders, or acting as the user without re-authentication.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The create-order API locks seats and creates a real order state transition, but the documentation does not warn that invoking it has external side effects and may reserve inventory or initiate a purchase flow. In this skill context, an agent could trigger seat locking prematurely or without clear user confirmation, causing unwanted reservations, failed purchases, or denial of availability to the user or others.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The send-qr API can send login or payment QR content to an external messaging channel using context metadata, but the documentation does not warn that data will be transmitted outside the current interaction surface. That creates a risk of sending sensitive authentication or payment artifacts to the wrong recipient, wrong channel, or an unintended integration target.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The code persists an authentication token to a local file and silently reloads it later, creating long-lived credential storage without any consent, disclosure, expiry handling, or additional protection beyond filesystem permissions. In an agent skill that performs ticket purchasing and payment-adjacent actions, stolen local tokens could let another local process or user session reuse the account and perform unauthorized actions or access account data.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: This code sends precise location data (`lat`/`lng`) and optional identifiers such as `token`, `userid`, and `uuid` to a third-party ticketing endpoint. In a movie-ticket booking skill this data flow is functionally relevant, but there is no evidence in this file of minimization, explicit consent gating, or clear disclosure before transmitting potentially sensitive user data, creating a privacy and tracking risk if the agent invokes it silently.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This code sends precise location data (`lat`, `lng`) and an authentication-like `token` to an external Maoyan endpoint. In a ticket-booking skill this may be functionally necessary, but the file contains no consent check, minimization, or user-facing notice before transmitting sensitive data, creating a privacy and account/session exposure risk if the values are over-collected, reused, or logged elsewhere.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The request includes user-linked identifiers such as userid and deviceInfoByQQ in outbound network parameters, and may also send token/uuid in headers, but this file contains no explicit consent check, minimization, or notice before transmitting them. In a ticket-booking skill this data flow may be functionally necessary, yet sending persistent identifiers without clear gating increases privacy and tracking risk if the skill is invoked unexpectedly or integrated into broader agent workflows.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The request forwards user-linked identifiers such as userid, uuid, token, and channelId to a third-party Maoyan endpoint. In this file there is no disclosure, minimization, or gating of those identifiers, so unnecessary tracking or linkage of a user's activity to a specific account/device can occur if upstream callers pass them through.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: This code reads a local credential-bearing AuthKey file and returns sensitive account metadata, including whether a token exists plus user identifiers and profile fields, to the caller without any access-control check, consent prompt, or minimization. In an agent skill context, exposing persisted authentication state and user account details through a tool output increases the risk of credential harvesting, account correlation, or follow-on abuse by other components or prompts that can invoke this script.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script persists a live authentication token together with user profile data to local storage without any visible safeguards such as encryption, permission restrictions, expiry handling, or explicit user consent messaging. In a ticket-booking skill, this is security-relevant because compromise of the local environment or logs/backups could expose an account session that may enable unauthorized ticket purchases, account access, or privacy leakage.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: This script sends user-supplied latitude, longitude, city ID, and a token to a third-party Maoyan endpoint without any evidence in this file of consent, minimization, or disclosure. Location and authentication-related data are sensitive; if collected or forwarded unexpectedly, this creates a privacy risk and may also expose session context to an external service beyond what the user intended.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The code prepares a command that sends QR media and a message to a target without any in-file disclosure, consent check, or user-visible confirmation step. Because the content includes login/authentication and payment prompts, silent sending materially increases phishing and social-engineering risk, especially if the destination identifiers are attacker-controlled or misbound.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.