ClawHub
Back to skill

Security audit

Trek 微信旅行 Agent

Security checks across malware telemetry and agentic risk

Overview

This skill coherently connects a travel-planning agent to the Trek mini program, with clearly disclosed remote MCP access and safeguards for writes and credentials.

Install only if you are comfortable giving Trek's remote MCP service access to your Trek travel data through a broad Agent Key. Use a separate key per agent, keep it in the runtime secret manager when possible, verify the CLI source before global installation, preview high-impact writes, and revoke the key immediately if it is exposed or no longer needed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (1)

External Transmission

Medium
Category
Data Exfiltration
Content
1. Never paste the `trek_` key into files, prompts, logs, screenshots, commits, or shell history intended for sharing.
2. Prefer the agent's native Streamable HTTP MCP support. Configure:
   - URL: `https://api.superd.fun/mcp`
   - Header: `Authorization: Bearer <user-key>`
3. Use the Trek CLI to install/sync this Skill, verify the connection, and diagnose failures:
Confidence
88% confidence
Finding
https://api.superd.fun/

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.