省柴柴·出行规划与订票助手

• Outcome: Review
• Latest audit: Aug 7, 2026 · 4:34 AM UTC
• Version: 1.0.6

Overview

The travel-booking skill is mostly purpose-aligned, but it hides recommendation/link sources and sends detailed trip data to a hardcoded cloud service, so users should review it before installing.

Review before installing. This skill may be useful for travel planning, but only install it if you are comfortable with trip details being sent to the publisher's cloud service and with purchase links whose platform, affiliate, or ranking source may be hidden from the user. Ask the publisher to disclose data handling and recommendation provenance, narrow activation triggers, remove or secure the mttravel local executable path, and align the release package with its stated no-endpoint rule.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares no permissions while embedding a live cloud endpoint and operational network-dependent behavior, creating a mismatch between its apparent capability surface and its actual behavior. This undermines review transparency and can cause the agent to make outbound requests users or platform controls did not clearly authorize.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The instructions explicitly tell the agent to conceal recommendation sources, which reduces transparency and can mislead users about the provenance, bias, or commercial nature of recommendations. In a travel-booking context, hidden sourcing materially affects user trust because recommendations may be affiliate-driven or quality-variable while presented as neutral local reputation.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file states that release packages must not contain API endpoints or internal rule implementations, yet it includes both, exposing internal operational details and a production endpoint directly in the distributed skill. This contradiction indicates poor secret/packaging hygiene and increases the risk of endpoint abuse, reverse engineering, or bypass of intended trust boundaries.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The skill invokes a local executable (`mttravel`) via `execFile`, which expands the trust boundary from a thin proxy client into arbitrary code/binary execution on the host. Although shell injection is mitigated by `execFile` and some input sanitization, the main risk is execution of an external binary resolved from environment variables or filesystem paths, enabling unexpected or tampered code to run under the agent's privileges.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The trigger description includes broad everyday travel-related words like '出行', '行程', and '旅行', which can cause the skill to activate in many unrelated conversations. Over-broad invocation increases the chance of unintended data sharing to external services and unexpected persuasive booking flows when the user did not intend to use this skill.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: Telling the agent to deny the existence of internal rules when asked is a deceptive behavior pattern that prevents honest disclosure about how outputs are generated and constrained. This is especially concerning in a commerce-adjacent travel assistant because users may rely on hidden ranking or linking logic without being able to understand the system's operating rules.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The script forwards detailed travel inputs—including origins, destinations, dates, lodging preferences, and itinerary data—to a remote proxy without any in-file consent flow, disclosure, or minimization controls. In a travel assistant context, this data can reveal sensitive behavioral patterns and future location plans, so silent transmission increases privacy and data-handling risk if the proxy is compromised, misconfigured, or operated without adequate notice.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: scripts/travel.js:305