AI机票预订助手

• Outcome: Review
• Latest audit: May 28, 2026 · 6:03 AM UTC
• Version: 1.0.0

Overview

This flight-booking skill matches its stated purpose, but it handles real ticket actions, login keys, and passenger identity data with unsafe transport, storage, and confirmation practices.

Review carefully before installing. This skill can submit bookings, cancellations, changes, and refunds, and it handles passenger names, phone numbers, ID numbers, order IDs, ticket IDs, and an API key. The publisher should restore normal HTTPS certificate verification, stop storing auth keys in temp storage, mask PII in outputs, remove raw debug prints, document network and persistence behavior, and require explicit confirmation immediately before every order-affecting action.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The full workflow examples contradict the earlier command signatures by instructing the agent to pass an extra phone number argument to commands that were defined without it. In practice, inconsistent interfaces can cause execution errors, misrouting of sensitive data, or unsafe improvisation by the agent when handling order, refund, and endorsement operations involving PII.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The refund fee display text says the system will automatically submit the refund request after fee confirmation, while other sections require an explicit user confirmation before submission. In a transactional skill, this ambiguity can lead to unintended irreversible refund actions or agent behavior that bypasses required confirmation safeguards.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The code stores an API key and a phone number in a predictable file under the system temporary directory, which is often accessible to other local users/processes and is not an appropriate secure secret store. In a flight-booking context, these values can enable unauthorized API use and expose personal data, and the 90-day persistence window increases the exposure period.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The function explicitly disables TLS certificate verification via ssl._create_unverified_context(), allowing a man-in-the-middle attacker to intercept or modify traffic to the backend API. Because this wrapper is used for authentication-related calls, an attacker could steal credentials, tamper with responses, or redirect users to a malicious endpoint.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The authenticated API wrapper also disables TLS certificate verification, exposing apiKey values and booking-related personal/business data to interception and tampering in transit. In this skill's context, compromised traffic could lead to unauthorized bookings, data disclosure, or manipulation of flight and refund operations.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The script prints the passenger's full phone number and full ID card number to stdout during order creation. Console output is commonly captured in logs, terminals, shell history, orchestration systems, or support transcripts, so this creates unnecessary exposure of highly sensitive personal data beyond what is required to complete a booking.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: Using a broad everyday phrase like '不要了' as a cancellation trigger can cause the agent to interpret casual conversation as authorization to cancel an order. Because cancellation is a state-changing action in a purchase flow, overly permissive intent matching increases the risk of accidental destructive operations.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: A broad trigger like '退票' can overlap with general questions about refund policy, pricing, or eligibility and may push the agent toward starting a refund workflow prematurely. In this skill context, refund operations affect real bookings and may expose or act on order data, so ambiguous matching is materially risky.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script prints the full `order_data` object immediately before submitting the API request, which can include sensitive booking data such as order IDs, ticket/product IDs, segment details, and potentially other passenger-related fields copied from the seat item. In a flight-booking skill, stdout is often captured by agent logs, terminals, orchestration layers, or support tooling, so this creates an avoidable data exposure risk even if the API call itself is legitimate.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script prints sensitive passenger data including name, phone number, identity document type/number, and ticket number directly to stdout with no masking, minimization, consent check, or role-based authorization visible in this layer. In an agent/tooling context, stdout may be logged, surfaced to unintended users, or retained in transcripts, increasing the risk of privacy leakage and downstream identity abuse.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script performs a real refund submission immediately after fetching order details, with no explicit confirmation step or secondary validation from the user before invoking refundApply. In a flight-booking skill, refund actions are financially sensitive and can be difficult or impossible to reverse, so accidental invocation, argument mix-ups, or malicious chaining by a higher-level agent could cause unintended ticket cancellation and monetary loss.

Vague Triggers

Medium

• Confidence: 87% confidence
• Finding: The description advertises a wide set of high-impact actions such as flight search, booking, rescheduling, and refund processing without stating explicit activation boundaries, confirmation requirements, or user-authentication constraints. In an agent ecosystem, broad wording can cause the skill to be invoked for ambiguous travel-related requests and increases the chance of unintended transactional behavior.

Static analysis

No suspicious patterns detected.