Security audit

ruqi-mobility

Security checks for vulnerabilities and agentic risk

Overview

This ride-hailing skill matches its purpose, but it stores account and location data in plaintext and can send live trip details and screenshots to chat targets, so users should review it carefully before installing.

Install only if you are comfortable giving the skill access to your RuQi account, phone number, saved home/work locations, live ride status, and driver details. Verify any RUQI_TARGET chat destination before use, avoid shared channels, and delete or rotate saved tokens and addresses when no longer needed.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs persistent storage of the user's API token, phone number, and home/work addresses in TOOLS.md for later reuse. Storing authentication material together with highly sensitive personal location data creates a durable compromise target and exceeds what is necessary for one-off ride fulfillment.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The skill mandates a background polling script that uses channel/target context to push updates externally, but this messaging behavior is not clearly declared in the manifest. Hidden outbound communication increases the risk of unauthorized data sharing, especially when order status, driver information, and potentially screenshots are involved.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The file exposes authentication primitives (`send_verification_code`, `login_with_verification_code`) that are more sensitive than the ride-assistance functions described in the skill metadata. Even if intended for legitimate account access, adding login flows expands the skill's authority and enables handling of phone numbers, OTPs, session cookies, and identity-bound actions without clear disclosure or scope limitation.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The script is built to send ride-order updates and optional screenshots to an external messaging destination defined by environment variables. That creates an outbound data-transfer channel for trip and driver information that is not clearly necessary for core ride-hailing functionality and can expose sensitive data to unintended recipients if the environment is misconfigured or abused.

Context-Inappropriate Capability

Low

Confidence: 80% confidence
Finding: Reading RUQI_CHANNEL and RUQI_TARGET from the environment allows the destination for outbound messages to be changed without code changes or user confirmation. By itself this is a weak signal, but in this file it directly controls where sensitive ride data may be sent, increasing the chance of accidental or unauthorized disclosure.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger phrases include broad, common expressions such as '回家', '上班', '下班', and '司机', which can cause accidental invocation during ordinary conversation. In a skill that can log in, estimate trips, create orders, and persist sensitive data, over-broad triggering materially raises the chance of unintended actions or data processing.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The skill requires storing the user's phone number and API token persistently but does not pair that behavior with a clear privacy or credential-storage warning to the user. Silent retention of reusable credentials is especially risky here because it enables future account access and links directly to the user's trip history and personal locations.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The skill automatically starts a background polling script after order creation without prominent user notice. Background monitoring can continue processing and transmitting trip status, driver details, and screenshots after the visible interaction ends, which creates privacy and expectation risks if not clearly disclosed.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The login flow sends a phone number, OTP, and hard-coded device/location identifiers, then returns the session cookie-derived token. This handles sensitive authentication and location data without any visible consent flow, minimization, or protection of the resulting credential, increasing the risk of privacy violations and account takeover if logs or downstream components are exposed.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: `create_ride_order` triggers a real-world transaction with financial and operational consequences, yet this file contains no confirmation, preview, or anti-misfire safeguard before placing the order. In an agent setting, accidental invocation, prompt confusion, or malicious chaining could create unwanted bookings and charges for the user.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: Order cancellation is a destructive external action that can disrupt a user's travel plans and potentially cause fees or service issues. Because the function forwards cancellation directly with no confirmation or contextual verification, an agent error or malicious prompt could cancel a legitimate ride unexpectedly.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The script transmits order updates and screenshots to an external target automatically, without any user-visible consent or confirmation at the point of sending. Because the payload may include trip details and driver information, silent transmission can violate user expectations and privacy requirements.

Ssd 3

High

Confidence: 99% confidence
Finding: The instructions require persistent storage of highly sensitive authentication data and personal details, including token, phone number, and home/work locations, in TOOLS.md for reuse. This creates a concentrated repository of secrets and precise personal movement data that could enable account takeover, stalking, or broader privacy compromise if exposed.

Ssd 3

High

Confidence: 99% confidence
Finding: The login flow explicitly tells the agent to extract the returned token and write both the token and phone number into TOOLS.md, turning a transient authentication event into persistent credential storage. In the context of a ride-hailing account, that can expose access to active orders, trip history, personal contact data, and future ride actions without requiring the user to re-authenticate.

Ssd 3

High

Confidence: 94% confidence
Finding: This section implements outbound messaging with optional media attachments, creating a direct exfiltration path for screenshots and ride data to an externally configured recipient. In the context of a mobility skill, screenshots can contain precise trip status, locations, and other personal information, making leakage materially harmful.

Ssd 3

High

Confidence: 96% confidence
Finding: The message body intentionally aggregates sensitive trip and driver details, including origin, destination, driver name, phone number, and vehicle information, for external delivery. That concentration of personal and operational data increases privacy risk and can enable stalking, harassment, or unauthorized tracking if sent to the wrong target.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/request.js:19