Security audit

分贝通机票助手

Security checks for vulnerabilities and agentic risk

Overview

This flight-booking skill has a coherent purpose, but it handles real travel transactions and sensitive identity data with unsafe storage, logging, and network security practices.

Review this skill before installing. It appears intended for real Fenbeitong flight operations, but you should not use it with production accounts or real passenger identity data until TLS verification is restored, credentials are stored in a protected per-user secret location, sensitive output is redacted, temp transaction files are secured or removed, endpoint overrides are constrained, and destructive actions require explicit confirmation.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (7)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/common.py:157
Finding: TLS Certificate Verification Is Disabled for All API Requests
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/common.py:15
Finding: Sensitive Requests Can Be Redirected to an Arbitrary Endpoint
Content: View full analysis
") return None api_url = get_api_url() payload = { "methodName": method_name, "apiKey": api_key, "businessParams": json.dumps(business_params), **extra_params } headers = { "Content-Type": "application/json" } try: data = json.dumps(payload).encode('utf-8') req = urllib.request.Request(api_url, data=data, headers=headers, method='POST') context = ssl._create_unverified_context() with urllib.request.urlopen(req, context=context) as response: response_data = response.read().decode('utf-8') return json.loads(response_data) ``` ### Technical Analysis The `FBT_API_URL` environment variable can replace the intended production endpoint with any URL. No validation restricts the scheme, hostname, port, or path. The API key and complete request payload are then sent to that destination. Environment configuration can be useful during development, but an unrestricted runtime override is unnecessary for normal Skill operation. It creates a direct credential-exfiltration primitive if a launcher, wrapper, inherited shell environment, or execution platform can influence environment variables. The disabled TLS verification further increases exploitability. ### Attack Path 1. An attacker gains control over the Skill process environment or persuades a user to run it through an attacker-controlled wrapper. 2. The attacker ...[truncated 703 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/common.py:20
Finding: API Key and Phone Number Are Stored in an Insecure Shared Temporary File
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/search_price.py:24
Finding: Tamperable Shared Temporary Files Are Trusted as Booking and Change-Order Input
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/create_order.py:100
Finding: Full Passenger PII Is Written to Standard Output
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/auth.py:95
Finding: SMS Verification Codes and Passenger PII Are Passed in Process Arguments
Content: View full analysis
") sys.exit(1) phone = sys.argv[2] code = sys.argv[3] verify_and_get_api_key(phone, code) ``` ```python def main(): if len(sys.argv) != 5: print("用法: python3 create_order.py ") print("示例: python3 create_order.py 1 \"张三\" \"13800138000\" \"110101199001011234\"") sys.exit(1) seat_index = sys.argv[1] passenger_name = sys.argv[2] passenger_phone = sys.argv[3] passenger_id = sys.argv[4] ``` ### Technical Analysis SMS verification codes, phone numbers, passenger names, and identity-document numbers are supplied as command-line arguments. Depending on the operating system and process configuration, arguments may be visible through process-listing tools, `/proc`, audit systems, job metadata, terminal history, or shell history. Although SMS codes are short-lived, their exposure during the verification window can enable account takeover. Identity information remains sensitive indefinitely. ### Attack Path 1. The victim runs the documented verification or order-creation command. 2. Sensitive values appear in the process argument vector. 3. Another local user, monitoring agent, process inspector, or audit collector records the command. 4. The attacker retrieves the OTP while valid or obtains the persistent PII from command history or logs. 5. A captured OTP may be used to complete authentication, while captured identity information may be used for fraud or social engineering. ### Impact Assessment The exposed scope includes authentication OTPs, phone numbers, passenger names, and full identity numbe ...[truncated 132 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/endorse_apply.py:140
Finding: Change-Order Payload Including Ticket Identifiers Is Dumped to Standard Output
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (34)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: The skill handles and displays sensitive passenger data including phone numbers, ID numbers, and ticket numbers, but the top-level description does not disclose that scope. Undisclosed PII processing reduces informed consent and may cause these sensitive values to be exposed in contexts where users or platform operators only expected flight search/booking functionality.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The skill handles and displays sensitive passenger data including phone numbers, ID numbers, and ticket numbers, but the top-level description does not disclose that scope. Undisclosed PII processing reduces informed consent and may cause these sensitive values to be exposed in contexts where users or platform operators only expected flight search/booking functionality.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The code disables TLS certificate verification by creating an unverified SSL context for outbound HTTPS requests. This allows man-in-the-middle attacks to intercept or modify flight-search, booking, and authentication traffic, which is especially dangerous because the skill handles apiKey credentials and personal/travel data.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill invokes local Python scripts, persists authentication data in ~/.fbt_auth.json, reads temporary files under /tmp, and performs outbound HTTP requests, yet it declares no tool scope or permission boundaries. This creates unnecessary privilege ambiguity: a host agent may allow broader file, environment, or network access than users expect, increasing the blast radius if the scripts are compromised or misused.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: L003 及全文均以中文规定技能用途和交互方式，但没有说明这是面向特定中文用户群的受限技能，也没有提供语言选择或用户选择其他语言的选项。根据规则，强制特定语言而无用户选择或明确正当说明，构成语言/locale 策略风险。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Broad trigger phrases can cause the skill to activate on ambiguous everyday language, leading to unintended flight-order operations in a transactional workflow. In a skill that can create bookings and interact with stored authentication, accidental invocation materially increases the risk of privacy exposure or unwanted actions.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description limits the skill to flight search, cabin query, booking, rescheduling, and ticket refund. However, the documented capability at L245-L273 adds standalone order cancellation, which is a distinct behavior not mentioned in the manifest scope.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Using vague cancellation triggers like casual phrases without strong context checks is dangerous because this skill can cancel orders, a destructive transactional action. In the context of a travel-booking skill with persisted auth and order state, accidental or adversarial phrasing could cause loss of reservations or business disruption.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: Generic triggers for rebooking/change operations may collide with ordinary conversation and activate a workflow that accesses order details and initiates fare-change processing. Because this skill can manipulate ticketed itineraries, over-broad activation creates a meaningful risk of unintended account/order actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Broad refund triggers are especially risky because refund submission is an irreversible or costly transactional action. Even though the document mentions fee confirmation, an over-broad activation phrase increases the chance of entering the refund workflow unintentionally and exposing order information or prompting destructive actions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow examples contradict the documented command signatures by appending an undocumented phone argument to multiple scripts. This inconsistency can cause unsafe implementations, accidental leakage of extra PII on the command line, and operator confusion about what data is actually required and transmitted.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: This Python code sends the user's verification code to an external API via call_api_without_auth(..., verifyCode=code). Although the script prints status messages, it does not explicitly warn the user that sensitive authentication data will be transmitted, and the file itself contains no disclosure comment beyond generic function naming.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest describes capabilities for flight search, cabin query, booking, ticket change, and ticket refund, but this script performs a generic order cancellation via the "cancelOrder" API. Canceling an order is not clearly the same as refunding a ticket, especially because the code refers to orders rather than tickets and does not indicate refund handling.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill persists the apiKey and phone number in a predictable file under the system temporary directory, which is often accessible to other local users or processes depending on platform configuration. Storing authentication material in temp storage without restrictive permissions or encryption increases the risk of credential theft and session hijacking.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The comment claims certificate verification should only be removed in production, but the code currently disables verification. This mismatch can mislead reviewers and operators into believing transport security is intact when it is not, increasing the likelihood the insecure behavior ships unnoticed.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The API wrapper sends apiKey and optional extra parameters such as name, phone, and idCard to a remote service via HTTP request payloads. While the function docstring documents parameters for developers, there is no clear user-facing warning that personal and authentication data may be transmitted to an external endpoint.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The authenticated API path repeats the same contradictory pattern: comments suggest proper TLS verification, while the code disables it. Because this path transmits apiKey and possibly passenger identity fields, the discrepancy directly undermines the confidentiality and integrity of authenticated requests.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script sends highly sensitive personal data (name, phone number, and government ID number) to an API during ticket booking without any explicit user-facing notice, consent confirmation, or minimization controls visible in this code path. In a travel-booking skill this transmission may be operationally necessary, but failing to warn users and clearly scope the disclosure increases privacy, compliance, and accidental over-sharing risk if the API, logs, or downstream systems are mishandled.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The script prints the full passenger phone number and ID number to stdout before creating the order, which can expose sensitive PII in terminal history, orchestration logs, agent transcripts, screenshots, and support tooling. In an agent skill context, stdout is often captured automatically, making this more dangerous than a local-only CLI because identifiers may be stored in centralized logs accessible by operators or other systems.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The script's natural-language interface, including docstrings, errors, status messages, and usage guidance, is presented only in Chinese. This imposes a fixed language on users without any opt-in, selection mechanism, or documented locale justification.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script prints the full order_data object to stdout immediately before submitting the endorse request. That object includes sensitive booking data such as order_id, ticket_ids, and detailed itinerary/segment information, which can be exposed through terminal history, logs, orchestration platforms, or agent telemetry. In a flight-booking skill, this context makes the issue more dangerous because the data is tied to real customer travel and order records.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This Python file contains docstrings and CLI output entirely in Chinese, including usage, status messages, and result headers. That effectively forces a specific language/locale for users without any opt-in or indication that the skill is intentionally limited to a Chinese-speaking environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: User-facing output, usage text, and inline natural-language descriptions are consistently in Chinese, and the width-calculation comment explicitly assumes Chinese/English display behavior. Under the language/locale policy, forcing a specific language without user opt-in is a policy concern unless the locale restriction is explicitly documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The script writes flight and seat-selection data to a temporary JSON file on disk, which can expose potentially sensitive travel/order information to other local users, processes, or later runs if the temp location is shared or insufficiently protected. In a booking workflow, persisted intermediate state can also be tampered with before a later step consumes it, creating confidentiality and integrity risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The natural-language strings shown to users, including errors, usage instructions, and all displayed order details, are fixed in Chinese. There is no indication that the skill is region-specific or that users can opt into a different language, which conflicts with the policy against forcing a specific language without user choice or justification.
Content: No source excerpt is available for this finding.