Security audit

rpg-travel: Game Pilgrimage · RPG 旅行：游戏圣地巡礼

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent travel-planning purpose, but its generator can write files outside the intended folder and can persist unsafe HTML from travel data into generated maps.

Review before installing. Use only with travel data you are comfortable sending through FlyAI, confirm any remembered personal details before searches, and avoid opening generated HTML from untrusted or externally influenced data until filename sanitization, HTML escaping, and URL allowlisting are fixed.

A.I.G

Vulnerability Patterns

Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/generate_map.py:51
Finding: Path Traversal Through Unsanitized Output Filenames
Content: View full analysis
Remediation: View remediation
str: value = re.sub(r"[^A-Za-z0-9._-]+", "_", value).strip("._") if not value: raise ValueError("Invalid filename component") return value[:100] base = out_dir.resolve() game = safe_filename_component(data.game_name) date = safe_filename_component(data.date_range or "undated") destination = (base / f"{game}-adventure-map-{date}.html").resolve() if base not in destination.parents: raise ValueError("Output path escapes the configured directory") ``` 4. Consider exclusive file creation or explicit overwrite confirmation to prevent accidental replacement of existing files. 5. Add tests for Unix traversal, Windows separators and drive paths, absolute paths, Unicode separators, empty sanitized values, and excessively long names. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: scripts/node_builder.py:8
Finding: Persistent HTML and JavaScript Injection in Generated Adventure Maps
Content: View full analysis
str: plot_summary = event.get("plot_summary", "") dialogues = event.get("dialogues", []) related_locs = event.get("related_locations", []) if not plot_summary and not dialogues and not related_locs: return "" html_parts = [ '
', '
📖 剧情概要
', ] if plot_summary: html_parts.append( f'
{plot_summary}
' ) for d in dialogues: speaker = d.get("speaker", "") text = d.get("text", "") html_parts.append(f'
') html_parts.append( f'
🗣️ {speaker}
' ) html_parts.append( f'
"{text}"
' ) html_parts.append(f"
") if related_locs: loc_tags = "".join( f'📍 {loc}' for loc in related_locs ) html_parts.append( f'
{loc_tags}
' ) html_parts.append("
") return "\n".join(html_parts) ``` Image URLs and other fields are inserted into HTML attributes without escaping: ```python pic = event.get("pic_url", event.get("picUrl", "")) game_pic = event.get("game_pic_url", ...[truncated 4156 chars]
Remediation: View remediation
`, `&`, Unicode line separators, and any `` sequence. Prefer a non-executable JSON element: ```html ``` The serialized JSON must still replace `<` with `\u003c` before insertion. 6. Validate and normalize all URLs independently of HTML escaping. 7. Add a restrictive Content Security Policy. Ideally, disallow inline scripts and limit image and navigation destinations to approved HTTPS hosts. 8. Add regression tests covering quote characters, angle brackets, ``, event-handler payloads, malformed URLs, and Unicode encoding edge cases. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/models.py:294
Finding: Unvalidated External URLs Permit Phishing, Unsafe Schemes, and Undisclosed Tracking Hosts
Content: View full analysis
str: item_id = item.get("itemId") or item.get("item_id") if item_id: return f"https://market.fliggy.com/item.htm?itemId={item_id}" jump_url = ( item.get("jumpUrl") or item.get("jump_url") or item.get("detailUrl") or item.get("detail_url") ) if jump_url: return jump_url ``` The returned value is rendered as a trusted purchase link: ```python items.append(f"""
✈️ 去程航班飞猪购买 📋 复制 💡 {reason}
""") ``` External image URLs are likewise embedded without host restrictions: ```python pic = event.get("pic_url", event.get("picUrl", "")) game_pic = event.get("game_pic_url", event.get("gamePicUrl", "")) game_img_src = game_pic if game_pic else pic real_img_src = pic game_img = ( f'
\n' f' \n' f'
🎮 游戏中
\n' f"
" ) ``` ### Technical Analysis The project documentation describes purchase links as Fliggy links and lists a limited set of third-party image hosts. The implementation does not enforce ei ...[truncated 2294 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (40)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: A second description-behavior mismatch is the undeclared use of public image or game endpoints for background and screenshot retrieval. Even if the destinations are public, hidden outbound access changes the skill's trust boundary and can leak user-selected game/travel context or violate deployment expectations.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 91% confidence
Finding: A second description-behavior mismatch is the undeclared use of public image or game endpoints for background and screenshot retrieval. Even if the destinations are public, hidden outbound access changes the skill's trust boundary and can leak user-selected game/travel context or violate deployment expectations.
Content: No source excerpt is available for this finding.

Vague Triggers

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The activation rule is overly broad: a bare game name or a vague travel-intent phrase can trigger the skill. In context, this is risky because the skill can then start collecting personal itinerary information, consult Memory, and query external services with configured credentials even when the user may have only been chatting generally about a game.
Content: No source excerpt is available for this finding.

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 667)May include surrounding context.
md
</head> <body>  <div class="bg-image" style="background-image: url('[BG_IMAGE_URL]'); filter: brightness(0.6) saturate(0.8);"></div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 722)May include surrounding context.
md
 </div>  <div class="budget-section"> <div class="budget-card"> <div class="budget-title">💰 冒险经费总览</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 754)May include surrounding context.
md
 <div class="toast" id="toast"></div>  <div class="lightbox-overlay" id="lightbox" onclick="closeLightbox()"> <button class="lightbox-close" onclick="closeLightbox()">✕</button> <img id="lightbox-img" src="" alt="放大图片" />

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 854)May include surrounding context.
md
1. 读取本文件的完整 HTML 模板 2. 根据用户选择的风格，替换 `:root` 中的 CSS 变量 3. 替换所有 `[占位符]` 4. 为每个行程节点生成 HTML 卡片，替换 `` 和 `` 之间的内容 5. 替换 `[LORE_TEXT]`、`[GAME_IMAGE_URL]`、`[REALITY_IMAGE_URL]` 等背景故事内容 6. 替换预算区域的 `[FLIGHT_TOTAL]`、`[HOTEL_TOTAL]` 等 7. 输出完整 HTML 文件

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 935)May include surrounding context.
md
</div> </div>  <div class="node-plot"> <div class="node-plot-title">📖 剧情概要</div> <div class="node-plot-summary">[剧情概要：描述游戏中与此地相关的关键剧情段落，2-3句话]</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 935)May include surrounding context.
md
</div> </div>  <div class="node-plot"> <div class="node-plot-title">📖 剧情概要</div> <div class="node-plot-summary">[剧情概要:描述游戏中与此地相关的关键剧情段落,2-3句话]</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 985)May include surrounding context.
md
</div> <div class="node-time">[入住日期] · [地址]</div>  <div class="node-plot"> <div class="node-plot-title">📖 剧情概要</div> <div class="node-plot-summary">[剧情概要：描述游戏中与此存档点/休息地相关的关键剧情]</div>

Hidden Instructions

High

Category: Prompt Injection
Confidence: 70% confidence
Finding: Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content: Scanner excerpt · references/pixel-map-template.md (reported line 985)May include surrounding context.
md
</div> <div class="node-time">[入住日期] · [地址]</div>  <div class="node-plot"> <div class="node-plot-title">📖 剧情概要</div> <div class="node-plot-summary">[剧情概要:描述游戏中与此存档点/休息地相关的关键剧情]</div>

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger examples are broad enough to match ordinary travel or gaming conversation, which can cause the skill to activate outside clear user intent. In an agent environment with tool access and external data queries, accidental invocation can lead to unnecessary network calls, confusing behavior, or unintended processing of user travel preferences.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 92% confidence
Finding: The skill directs the agent to use network access, read reference files, and write output files, but it does not declare an explicit tool scope or allowed-tools boundary. Without least-privilege constraints, an agent may invoke broader capabilities than users expect, increasing the chance of unintended file access, outbound requests, or data exposure during execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill asks for departure city, budget, and travel preferences and then instructs use of external travel-query tooling, but it does not warn users that this data may be sent to third-party services using configured credentials. Missing disclosure creates privacy and compliance risk because users cannot meaningfully consent to external processing of their itinerary data.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger rules allow activation from very broad inputs like a game name or generic travel-related phrases. Over-broad invocation can cause the skill to capture unrelated conversations, prompt for personal itinerary details, or initiate external lookups when the user did not clearly intend to use this skill.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Several descriptive triggers are ambiguous enough to match ordinary conversation and are not tightly scoped to this skill. While not directly enabling code execution, this increases accidental activation risk and can lead to unnecessary collection or transmission of user context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill relies on configured FlyAI credentials and real flight/hotel/POI queries, but it does not clearly tell the user that their departure city and itinerary inputs will be sent to external services. This undermines informed consent and creates privacy risk around travel-related personal data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: 该技能说明、交互问题、示例输出和流程均默认并强制为中文，没有说明可根据用户偏好切换语言。若组织要求避免未经用户选择而固定语言，这种设计可能构成自然语言层面的 locale 策略违规。
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger phrase list contains broad conversational phrases without exclusion rules or contextual checks. This increases accidental invocation risk and can cause unintended collection of travel details or external lookups tied to the user's interests and location.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The instruction to reuse previously stored user information from memory without fresh confirmation is a direct data-handling flaw. In this skill, the risk is amplified because the reused data may be combined with external travel-service lookups, turning stale or previously disclosed personal information into a new outbound disclosure.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The title and instructions are entirely in Chinese and line L03 uses absolute language ('都必须') to require inclusion of Fliggy purchase links, but the file provides no indication that Chinese is optional or limited to a China-specific audience. Under the policy, forcing a specific language or locale without user opt-in can be a natural-language policy violation.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: 该 markdown 文档全文以中文编写，并通过中文标题、参数说明和注意事项默认要求使用中文语境，但未说明这是区域限定文档，也未提供其他语言或用户选择语言的说明。根据规则，若技能强制特定语言而没有用户 opt-in 或明确、合理的地域性说明，属于自然语言政策风险。
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire reference is written in Chinese and provides Chinese-specific search terms such as '取景地' and '圣地巡礼' without indicating that language selection is optional. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation unless clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The title and all user-facing template text are in Chinese, which implies the skill may force a specific language/locale. The policy requires either offering language choice or clearly documenting a justified locale restriction, neither of which appears in this file.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The HTML template hard-codes lang="zh-CN", which imposes a specific language/locale on generated output. The surrounding markdown also presents the skill entirely in Chinese and does not indicate that this locale is optional or limited to a China-specific use case.
Content: No source excerpt is available for this finding.