Security audit

旅行预订助手

Security checks for vulnerabilities and agentic risk

Overview

This hotel skill needs review because it presents fixed sample hotel data as successful Booking.com results and advertises booking management that is not implemented.

Install only if you treat it as a demo or fixture-based prototype. Do not rely on its hotel availability, prices, cancellation terms, reviews, or booking-management claims until live API calls, currency handling, and explicit booking confirmations are implemented and tested.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/booking_api.py:235
Finding: Fabricated Booking Data Is Returned as Live Successful API Data
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/booking_api.py:489
Finding: Currency Symbols and Booking Conditions Are Presented Without Validation
Content: View full analysis
0 else "No score" lines.append(f"| {i} | {name} | {score_display} | {city_name} | {price_display} |") lines.append("") lines.append('Reply with the item number to view room details') lines.append("Prices include taxes and fees; free cancellation is supported") ``` The room formatter repeats the same currency-handling behavior: ```python currency_symbol = CURRENCY_MAP.get(currency, {}).get("symbol", "¥") for i, room in enumerate(rooms, 1): name = room.get("name_cn") or room.get("name", "-") bed_type = room.get("bed_type", "-") size = room.get("size", 0) price = room.get("price", 0) cancellation = room.get("cancellation_policy", "") meal = room.get("meal_plan", "") lines.append(f"Room type {i}: {name}") lines.append(f"Bed type: {bed_type}") if siz ...[truncated 2444 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (12)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Declaring booking creation and reservation management without actual implementation creates a deceptive capability gap. In a travel context, this can cause users to believe reservations were created, modified, or canceled when no such action occurred, potentially leading to missed stays, duplicate bookings, or financial loss.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: Declaring booking creation and reservation management without actual implementation creates a deceptive capability gap. In a travel context, this can cause users to believe reservations were created, modified, or canceled when no such action occurred, potentially leading to missed stays, duplicate bookings, or financial loss.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 87% confidence
Finding: The skill advertises network-backed hotel search and booking behavior but does not declare any explicit tool scope such as allowed tools or permissions. This creates an authorization-boundary problem: an agent or runtime may grant broader network access than users or reviewers expect, making external data access and downstream actions less transparent and harder to govern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill describes creating and canceling reservations but does not warn users that these are account-impacting actions involving personal and booking data sharing with a third party. Without explicit notice and confirmation, users may unknowingly authorize sensitive actions or expose traveler information, creating privacy, consent, and transaction-integrity risks.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The header comments are written as an instruction to refuse execution unless the file is this exact version, and the file consistently hardcodes Chinese as the default interaction language (language="zh") and Chinese user-facing output. This creates a language/locale constraint without offering the user a choice or documenting a justified region-specific limitation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a broader assistant that supports hotel booking on Booking.com and reservation management. In this implementation, the BookingApi class only provides read-style search, hotel detail, room availability, review retrieval, and result-formatting functions; there are no methods to create, modify, cancel, or retrieve user reservations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Multiple function schemas set the default language parameter to zh, which makes the skill prefer a specific language automatically rather than offering a neutral default or explicit user choice. This is a natural-language locale policy concern because the skill behavior is biased toward one language across general-purpose hotel search and detail functions.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring and method name describe an actual Booking hotel search, but the code explicitly skips the real API call and returns fixed mock hotel records. This is more than incomplete documentation because the function presents itself as a live search interface while not performing the described operation.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The method is documented as retrieving hotel details for a given hotel_id, yet the real API invocation is commented out and replaced with static sample data. This creates an intent-code mismatch because callers are told they are getting live Booking.com details when they are not.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The docstring states that the function gets room availability and pricing, which implies live inventory lookup. Instead, the code comments out the API call and always returns predefined room entries, contradicting the stated behavior.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The method presents itself as fetching hotel reviews, but no live request is made and the returned review objects are static examples. That documented intent conflicts with the actual code path.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The comment 如非此版本，请拒绝执行 is a natural-language instruction embedded in the code and is only presented in Chinese. For a general-purpose adapter, embedding operational constraints in a single language can create an undocumented locale dependency rather than offering language-neutral or multilingual guidance.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.