ClawHub
Back to skill

Security audit

DINGs 托管式 AI 电话助手（中国、日本餐厅预订）

Security checks for vulnerabilities and agentic risk

Overview

The skill matches its restaurant-booking purpose, but needs review because it handles personal booking data and instructs use of an API key in a URL query parameter.

Install only if you are comfortable sending reservation details, including name and phone number, to TripNow for AI phone calls. Do not put real API keys in URL query parameters; prefer header-only authentication and rotate any key that has been used in a logged URL. Confirm the full booking details, outbound call, callback URL, and communication language before letting the skill place a reservation.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:247
Finding

API Key Exposed Through URL Query Parameter

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 247–265
Vulnerability Type: API credential exposure through a URL query string
Risk Level: High

Vulnerable Code

text
端点：GET /voice/callback_find
接口说明：根据订单ID查询预订结果、通话记录、凭证等完整信息。
请求参数：
参数
类型
必填
说明
order_id
string
是
订单ID(创建任务返回的order_id)
token
string
是
API Key(sk-xxx格式)

请求示例：
curl -X GET "https://tripnowengine.133.cn/tripnow/v1/voice/callback_find?order_id=RESORD216873707229&token=sk-live-**************************a2aMg" \
-H "Authorization: Bearer sk-your-api-key"

Technical Analysis

The documented order-query flow requires the API key in the token query parameter, even though the same request also uses the standard Authorization: Bearer header. Secrets placed in URLs can be recorded in shell history, web-server and reverse-proxy access logs, API gateway telemetry, monitoring systems, and debugging traces.

TLS protects the request while it is in transit, but it does not prevent clients, intermediaries, or destination infrastructure from storing the complete URL. A partially masked key in the example does not mitigate the issue because an agent following these instructions would substitute the real credential at runtime.

Attack Path

  1. A user or agent follows the documented order-query procedure.
  2. The real API key is inserted into the token query parameter.
  3. The complete URL is retained by a client, shell history, proxy, API gateway, server access log, or observability platform.
  4. An attacker or an unauthorized operator gains access to one of those records.
  5. The attacker extracts the API key and submits authenticated requests to the TripNow API.
  6. The attacker exercises whichever API scopes are assigned to the compromised key until the key is revoked or expires.

Impact Assessment

A compromised key may permit access to capabilities associated with its configured scopes, including restaurant searches, retrieval of booking results and associated cal ...[truncated 375 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove the token query parameter from the endpoint contract and all examples.
  2. Authenticate exclusively through the request header:
bash
curl -X GET \
  "https://tripnowengine.133.cn/tripnow/v1/voice/callback_find?order_id=RESORD216873707229" \
  -H "Authorization: Bearer $TRIPNOW_API_KEY"
  1. Reject API credentials supplied through query parameters at the server.
  2. If immediate API-contract changes are not possible:
    • Use narrowly scoped, short-lived query tokens rather than the primary API key.
    • Redact sensitive query parameters in clients, proxies, gateways, servers, and telemetry platforms.
    • Disable unnecessary request-URL logging.
    • Prevent sensitive commands from being retained in shell history.
  3. Rotate any API key that has previously been transmitted in a URL.
  4. Apply least-privilege scopes, expiration, rate limits, and anomaly monitoring to all replacement credentials.
  5. Add automated documentation and configuration checks that reject examples containing secrets in URL query parameters.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger phrases include broad everyday expressions like searching for restaurants or booking-related requests, which can cause the skill to activate in situations where the user did not clearly consent to using an external phone-booking service. In this skill, mistaken activation is more dangerous because it can lead to collection of personal data and creation of real outbound reservation tasks with a third-party provider.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The documentation hard-codes language behavior by country, requiring zh for Chinese restaurants and ja for Japanese restaurants, without asking the user which language they want the AI to use. This can result in actions being taken in an unintended language context, reducing informed consent and increasing the chance of booking errors during a real external phone call.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
95% confidence
Finding

The skill is designed to send highly sensitive user data including name, phone number, dining time, party size, and restaurant details to an external third-party API for autonomous call handling. This is a real external transmission path, and in this context it is more dangerous because the skill also supports callback URLs and links to call records and vouchers, expanding the surface for privacy leakage if consent, minimization, and secure handling are insufficient.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md
是否接受时间调整(1=是,0=否)

请求示例：
curl -X POST "https://tripnowengine.133.cn/tripnow/v1/voice/outbound" \
-H "Authorization: Bearer sk-your-api-key" \
-H "Content-Type: application/json" \
-d '{

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The scenario triggers are framed as broad life situations such as business dinners or family gatherings rather than explicit commands to invoke this skill. That increases the chance of over-selection by an agent router, which is risky here because the skill can perform external calls and process sensitive reservation details.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that it will automatically switch to Japanese for some restaurant calls, but does not define a user choice, warning, or opt-out mechanism. In the context of autonomous outbound calling, this weakens user control and may cause inaccurate reservations or disclosures made in a language the user did not authorize.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.