Security audit

tc特价机票查询

Security checks for vulnerabilities and agentic risk

Overview

The skill is not clearly malicious, but it needs review because it can return fabricated flight prices as usable results, overstates monitoring behavior, and installs persistent local skill files with limited safeguards.

Review this skill before installing. Use a virtual environment and pinned dependencies, configure the Feishu webhook only if you are comfortable sending route/date/price information to that destination, and do not rely on returned fares unless the output clearly shows a live source rather than mock_data. Avoid using the monitoring feature for real alerts until subscription creation and price-drop notification behavior are verified.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: install.py:14
Finding: Unpinned Dependencies Are Installed from the Active Package Index
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/tongcheng_api.py:143
Finding: Failed Live Queries Silently Return Fabricated Flight and Price Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (46)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Returning simulated flight data on query failure without clearly distinguishing it from real third-party pricing can mislead users into making decisions on false information. The undocumented write to /tmp/tongcheng_api_test.json also adds an unexpected local data artifact that may leak query details or test content.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The README documents outbound Feishu webhook notifications and persistent local storage for subscriptions/configuration, but it does not clearly warn users that flight queries, monitoring preferences, and webhook destinations may be stored locally and transmitted to a third-party service. In a skill that handles user travel intent and automated notifications, this omission can lead to unintended data disclosure or retention without informed user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The release notes describe automatic Feishu webhook notifications and persistent subscription/history storage, but they do not prominently disclose the privacy and security implications of sending flight/query data to a third-party webhook or storing user travel preferences on disk. This can lead users or operators to enable the skill without informed consent, increasing the risk of unintended data exposure, especially because travel routes, dates, and monitoring history may be sensitive.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill declares capabilities that imply file I/O, network access, and shell execution, but it does not define any explicit tool scope or permission boundaries. This increases the chance that a host agent grants broader privileges than users expect, enabling unintended local file modification, external requests, or command execution if the implementation is invoked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill describes subscriptions and Feishu push notifications but does not clearly warn users that it stores query/history data locally and transmits flight details through a webhook. This weak disclosure can lead to unintentional sharing of travel patterns or itinerary-related data, which is privacy-sensitive even if it does not include formal identity documents.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This JSON example uses Chinese query text, Chinese airline names, Chinese discount notation, and Chinese recommendation reasons throughout, indicating a fixed language/locale behavior. Because no user choice or justification for the locale is present in the file, it reflects a natural-language locale policy concern under the rule.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The file-level description and all user-facing messages are written exclusively in Chinese, and the examples and usage text assume Chinese-language queries. There is no indication that users may choose another language or that the skill is intentionally limited to a Chinese-only, region-specific context.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The code tells users that a price monitor has been created and that Feishu price-drop notifications will be sent, but it only appends a confirmation message to the output and performs no persistence, scheduling, or notification setup. In a travel-booking context, this is a deceptive capability claim that can cause users to rely on alerts that will never arrive, potentially leading to missed fares or operational mistakes.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script writes raw natural-language queries and results verbatim to log files, which may contain sensitive personal travel information such as cities, dates, itineraries, and possibly other free-form details entered by users. In a travel-assistant context, persistent local storage of such data increases privacy exposure and can leak user activity to other local users, backups, or log collectors.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This code file contains user-facing natural-language strings exclusively in Chinese, including installation status and usage instructions. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale constraint is explicitly justified, which is not present here.
Content: No source excerpt is available for this finding.

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · install.py (reported line 23)May include surrounding context.
python
for dep in dependencies: print(f" 安装 {dep}...") try: subprocess.check_call([sys.executable, '-m', 'pip', 'install', dep]) print(f" ✅ {dep} 安装成功") except subprocess.CalledProcessError: print(f" ⚠️ {dep} 安装失败，请手动安装: pip install {dep}")

subprocess module call

Medium

Category: Dangerous Code Execution
Confidence: 70% confidence
Finding: subprocess module calls execute external commands. Without careful input validation, this enables command injection.
Content: Scanner excerpt · install.py (reported line 42)May include surrounding context.
python
return False try: subprocess.check_call([sys.executable, str(register_script), str(skill_dir)]) return True except subprocess.CalledProcessError as e: print(f"❌ 注册失败: {e}")

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The sample headers explicitly set Accept-Language to zh-CN,zh;q=0.9,en;q=0.8, which imposes a locale preference in natural-language configuration. Under the policy, forcing a specific language or locale without user choice or documented region-specific justification is a violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: This markdown file contains all user-facing examples, rules, and guidance exclusively in Chinese. Under the policy rules, forcing a specific language without user opt-in or a clearly documented regional justification is a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This code file contains natural-language docstrings and user-facing strings exclusively in Chinese, including the module description and runtime messages. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly justified, which it is not here.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The script installs a local skill by copying an arbitrary folder into ~/.easyclaw/skills and derives the destination name from untrusted SKILL.md content. For a flight-price query skill, bundling a filesystem-modifying registration utility is outside the stated user-facing purpose and increases supply-chain risk: a user running it grants the package write access to their local skill environment and potentially enables persistence of unwanted code.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code can replace an existing skill directory by moving it to a backup and then copying new contents into its place, using a target path influenced by SKILL.md metadata. This creates a local overwrite/relocation capability that is not justified by a flight-monitoring skill and could be abused to clobber another installed skill, introduce malicious replacement content, or disrupt the user's environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: This code file contains natural-language text that forces a specific language/locale experience for users, including the module docstring and later CLI output. The policy explicitly calls for flagging language-policy violations when a skill forces a specific language without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code’s natural-language interface is explicitly limited to Chinese: the module docstrings describe Chinese-language parsing, the city lists and keywords are Chinese-only, and date parsing is forced to languages=['zh']. That constitutes a language/locale constraint without any user opt-in or documented justification in the file.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.