ClawHub
Back to skill

Security audit

飞猪租车智能推荐助手

Security checks across malware telemetry and agentic risk

Overview

This rental-car recommendation skill is coherent and purpose-aligned, with the main caveat that users should understand their trip details may be sent to Fliggy/Mtop for live results.

Before installing, be aware that searches may send your destination, rental dates, passenger count, and filter preferences to Fliggy/Mtop to retrieve live vehicle inventory and pricing. Do not provide account cookies, payment information, identity documents, or unrelated personal data through this skill; complete any booking only through the trusted OTA page it opens.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill instructs sending detailed user travel data such as destination, dates, city codes, and preference filters to a live external Mtop API, but it does not disclose that this information will be transmitted off-platform or obtain user consent. In a travel-booking context this is not inherently malicious, but it creates a real privacy and transparency issue because users may not expect their itinerary and related metadata to be shared with a third-party service.

VirusTotal

61/61 vendors flagged this skill as clean.

View on VirusTotal