TravelSmart

• Outcome: Review
• Latest audit: May 28, 2026 · 11:57 AM UTC
• Version: 1.0.2

Overview

The travel assistant mostly does what it claims, but its web server also exposes an unauthenticated Feishu message relay that is broader than the travel use case.

Review server.py before running the web server. Remove or protect /notify, bind only to localhost unless you intentionally expose it, set FEISHU_CHAT_ID explicitly, limit Feishu app permissions, and avoid entering sensitive home, hotel, or itinerary details unless you are comfortable sending them to the configured map or LLM providers.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 81% confidence
• Finding: The skill documentation declares no permissions even though the implementation uses environment variables and network access. This weakens reviewability and user consent because operators may not realize the skill can read secrets such as API keys and make outbound requests to third-party services. In a skill that also integrates Feishu and web endpoints, undocumented capabilities increase the chance of unsafe deployment assumptions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose is a travel decision assistant, but the code reportedly exposes extra capabilities including a generic /notify endpoint that can forward arbitrary text to Feishu, token acquisition for tenant access, and a geocode API endpoint not clearly disclosed. This is dangerous because hidden or under-documented messaging and callback functionality can be abused for spam, unauthorized notifications, data exfiltration, or use of the service as a proxy to external systems. The skill context makes this more concerning because external HTTP exposure and chat-platform integration expand the attack surface beyond the stated travel use cases.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The server exposes a generic /notify endpoint that accepts arbitrary text and relays it to a Feishu chat, but it has no authentication, authorization, or origin validation. This creates an externally reachable message relay that attackers can use for spam, social engineering, alert spoofing, or operational noise, and it is not tightly scoped to the advertised travel-assistant scenarios.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The callback handling plus outbound Feishu messaging extends the service into a generic notification bridge without any access control. In the context of a travel recommendation skill, this unrelated capability broadens the attack surface and enables misuse of the server's trusted messaging integration for unauthorized communications.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The router sends the full raw user input directly to an external LLM API. In a travel assistant, user text can contain sensitive location, itinerary, and personal travel details, and this file provides no notice, consent flow, redaction, or minimization before transmission. The skill context increases concern because travel-related inputs often reveal real-time whereabouts and plans.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code logs precise user longitude and latitude together with travel context (`预算`, `人数`) via `logger.info`, which can expose sensitive location data to application logs, operators, or downstream log processors without any visible consent or minimization. In a travel-assistant skill, location is core personal data, so retaining raw coordinates increases privacy risk and potential misuse if logs are accessed or breached.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pyyaml>=6.0
loguru>=0.7.0

• Confidence: 97% confidence
• Finding: The dependency is specified with a lower bound only (`requests>=2.31.0`), so installations may resolve to different versions over time. This weakens reproducibility and can silently pull in a newly introduced vulnerable or incompatible release, increasing supply-chain risk for the skill.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pyyaml>=6.0
loguru>=0.7.0

• Confidence: 97% confidence
• Finding: `pyyaml>=6.0` is not pinned to a specific reviewed release, allowing future installs to select any newer version. For a package with a history of unsafe deserialization issues, this expands exposure to unreviewed versions and undermines build reproducibility.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

requests>=2.31.0
pyyaml>=6.0
loguru>=0.7.0

• Confidence: 96% confidence
• Finding: `loguru>=0.7.0` allows non-deterministic dependency resolution and future version drift. While this is often done for convenience rather than malice, it still creates avoidable supply-chain and stability risk because deployments may not all use the same reviewed package set.

Static analysis

No suspicious patterns detected.