Security audit

smart-hotel-search

Security checks for vulnerabilities and agentic risk

Overview

The skill appears purpose-aligned for hotel search, but it asks users to install unpinned third-party tools and connect an authenticated Chrome session without enough safety disclosure or scoping.

Review this skill carefully before installing. Use a dedicated Chrome profile or test account, avoid keeping unrelated sessions or sensitive data in that browser profile, verify the npm packages and extension source, and understand that hotel queries and preferences may be sent to Xiaohongshu, Fliggy, and related tooling.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

Location: references/installation.md:27
Finding: Unpinned Global Dependencies and Unverified Browser Extension
Content: View full analysis
Remediation: View remediation
npm install -g @jackwener/opencli@ ``` 2. Publish expected npm integrity hashes, package tarball digests, and Chrome-extension artifact checksums through a trusted channel. Require users to verify them before installation. 3. Record the reviewed package versions and extension release identifier in `SKILL.md` and `references/installation.md`. Do not instruct users to install an unspecified “latest” release. 4. Prefer project-local or isolated installation over global installation. Run the tools in a dedicated container, virtual machine, or restricted operating-system account where practical. 5. Use a dedicated Chrome profile for this Skill. That profile should contain only the Xiaohongshu session required for the workflow and no unrelated accounts, credentials, payment sessions, or sensitive browsing data. 6. Document and review all extension permissions and host access. Restrict the extension to the minimum required domains rather than granting access to all sites. 7. Prefer a verified browser-store release with controlled updates. If Developer Mode installation is necessary, require a fixed signed artifact and checksum verification. 8. Disable npm lifecycle scripts during acquisition where compatible, inspect the package, and only then install or enable the reviewed artifact. 9. Add a controlled update process requiring security review whenever dependency versions, checksums, extension permissions, or release sources change. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest description and nearly all user-facing instructions are written only in Chinese, and the examples, trigger conditions, and workflow assume Chinese-language queries. There is no indication that users may choose another language or that the skill is intentionally limited to a China-specific audience for compliance or regional reasons.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The examples direct the agent to query third-party services (小红书, 飞猪) and present booking links, but they do not instruct the agent to disclose that user queries, destinations, dates, and preference data will be sent to external platforms. This creates a privacy and transparency gap: users may unknowingly share personal travel plans or sensitive preferences with third parties, and the examples normalize that behavior as default workflow.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation explicitly instructs users to install and use a tool that reuses a locally logged-in Chrome session to operate websites, including Xiaohongshu, but it does not clearly warn that the tool may access account data, act with the user's authenticated privileges, or perform actions on the user's behalf. In a skill context, this omission is dangerous because users may unknowingly grant broad access to a third-party CLI/extension combination tied to an authenticated social-media account, increasing the risk of account misuse, privacy exposure, and unintended actions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The file consistently presents user inputs, outputs, and operational guidance exclusively in Chinese, which implies a fixed language behavior. There is no indication that the user can choose another language or that the skill is intentionally limited to a Chinese-language/China-market context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 82% confidence
Finding: L110-L123 直接要求登录小红书并使用中文查询“三亚酒店”，整体流程默认中文平台和中文内容，没有说明这是可选的区域化示例，也未提供用户语言/地区选择。按规则，这类未提供 opt-in 的语言或 locale 约束可构成自然语言政策问题。
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.