Security audit

AI Go Hotel

Security checks for vulnerabilities and agentic risk

Overview

This hotel-search skill is not plainly malicious, but it needs review because it ships a reusable bearer credential and includes unpinned local server setup instructions.

Review before installing. Rotate or remove the packaged bearer token, use per-user secrets instead, avoid sending sensitive details in raw hotel queries, and only run the optional local server from a pinned and reviewed revision with locked dependencies.

A.I.G

Vulnerability Patterns

Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T09 · Insecure Skill Coding Practices

Error

Location: mcp.json:4
Finding: Hardcoded Bearer Credential Exposed in MCP Configuration
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:22
Finding: Mandatory Transmission of Unredacted User Queries to a Third-Party Service
Content: View full analysis
", "Content-Type": "application/json" } } } } ``` `README_EN.md:15-20`: ```markdown ### Input Parameters - `originQuery` (string, required): Original user query. - `place` (string, required): Location name (city/airport/POI/address, etc.). - `placeType` (string, required): Location type, supports `城市`, `机场`, `景点`, `火车站`, `地铁站`, `酒店`, `区/县`, `详细地址`. - `queryParsing` (boolean, optional, default: `true`): Parse natural-language intent. ``` ### Technical Analysis Hotel searches legitimately require selected information such as destination, dates, occupancy, and preferences. However, the Skill additionally requires the entire original natural-language query even after the query has been converted into structured fields. The raw query can contain information that is unnecessary for the search, including names, contact details, home or work addresses, personal circumstances, or other unrelated sensitive content. The supported structured ...[truncated 1580 chars]
Remediation: View remediation

T03 · Remote Payload Retrieval and Execution

Error

Location: README_EN.md:229
Finding: Mutable Remote Repository Is Downloaded and Executed Without Integrity Verification
Content: View full analysis
Remediation: View remediation
``` 2. Publish signed release tags or signed artifacts and document signature verification. 3. Provide a cryptographic checksum for release archives and require validation before execution. 4. Re-audit the exact pinned revision whenever it is updated. 5. Run the server as a dedicated unprivileged account or inside a restricted container. 6. Restrict filesystem mounts, environment variables, outbound network access, and access to host credentials. 7. Do not run the installation or server with administrator or root privileges. 8. Add automated monitoring for unexpected changes to the pinned repository and release artifacts. ]]>

T08 · Insecure Dependencies

Warning

Location: README_EN.md:235
Finding: Dependency Installation Lacks Version and Integrity Controls
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The file embeds a live-looking Bearer token directly in the MCP configuration, which exposes a reusable secret to anyone who can read the skill package. An exposed token can be copied and used to access the remote MCP service as this skill, potentially leading to unauthorized API use, data access, quota exhaustion, or billing abuse. The hotel-search context does not reduce risk; because this token authorizes external service access, bundling it in a distributable skill makes exploitation straightforward.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The README states that the language parameter defaults to zh_CN, which imposes a specific locale unless the caller explicitly overrides it. This is a natural-language locale policy concern because the documentation does not present the default as optional or ask for user preference first.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.