Destinia

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:15 PM UTC
• Version: 1.0.0

Overview

The skill is a coherent hotel-search integration, but it asks users to persist an API key and run unpinned npm tools with too little protection or warning.

Review before installing. Prefer pinned package versions, avoid placing the API key directly in prompts, restrict permissions on any credential-bearing config file, and rotate the Destinia key if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILLS.md:15

Finding

Unpinned npm Packages Are Installed and Executed

Content

View full analysis

Vulnerability Details

File Location: SKILLS.md, lines 15-39; the same unsafe npx pattern is repeated at lines 49-64
Vulnerability Type: Unpinned and unverified third-party dependency execution
Risk Level: Medium

Vulnerable Code

markdown

You need to install `mcporter` package as your mcp client to do so just execute this command
                                       

text

 npm install -g mcporter

text

Then you can configure a conexion to Destinia inside mcporter's configuration file `~/.openclaw/workspace/config/mcporter.json`

The configuration you should as is this:

{ "mcpServers": { "destinia": { "command": "npx", "args": [ "mcp-remote", "https://mcp.destinia.com/sse", "--header", "Authorization:Bearer <api_key>" ] } } }

text

Technical Analysis

The instructions install mcporter globally without specifying a reviewed version, integrity hash, lockfile, or verified publisher. They also configure npx to execute mcp-remote without a version. Depending on the local npm configuration and cache, npx can retrieve the current package release from the configured npm registry at execution time.

Consequently, the code executed on a user's system is mutable after the Skill has been audited. Package lifecycle scripts and the package executable run with the permissions of the user invoking npm or the MCP client. A compromised publisher account, malicious package release, registry substitution, dependency confusion condition, or unexpected upstream change could therefore introduce arbitrary local code execution.

Attack Path

1. An attacker compromises the publisher, distribution channel, or dependency chain of mcporter or mcp-remote, or publishes a malicious release through an applicable package-resolution attack.
2. A user or agent follows the Skill instruc ...[truncated 995 chars]

Remediation

View remediation

Remediation Suggestions

• Pin every npm package to an explicitly reviewed version, such as mcporter@X.Y.Z and mcp-remote@X.Y.Z.
• Install dependencies locally rather than globally and commit an appropriate lockfile with integrity metadata.
• Verify the official package name, publisher, repository, release provenance, and package signatures where supported.
• Review package contents and lifecycle scripts before installation.
• Install the verified package in advance and execute it with npx --no-install so runtime invocation cannot silently download a new release.
• Use a restricted service account or sandbox with only the filesystem and network permissions required for hotel searches.
• Establish a dependency-update process that requires review and testing before pinned versions are changed.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILLS.md:21

Finding

API Key Is Stored in Plaintext Configuration and Passed in Process Arguments

Content

View full analysis

Vulnerability Details

File Location: SKILLS.md, lines 21-39; the Auto-setup prompt repeats the pattern at lines 45-64
Vulnerability Type: Plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

markdown

Then you can configure a conexion to Destinia inside mcporter's configuration file `~/.openclaw/workspace/config/mcporter.json`

The configuration you should as is this:

{ "mcpServers": { "destinia": { "command": "npx", "args": [ "mcp-remote", "https://mcp.destinia.com/sse", "--header", "Authorization:Bearer <api_key>" ] } } }

text

The Skill further instructs the user to replace the placeholder before using its Auto-setup prompt:

markdown

⚠️⚠️⚠️ Replace `<api_key>` with you api key before executing the prompt ⚠️⚠️⚠️

Technical Analysis

The documentation directs users to substitute a real API key directly into ~/.openclaw/workspace/config/mcporter.json. This stores the credential in plaintext. The same value is supplied as part of the args array and therefore becomes a command-line argument when the MCP process starts.

Plaintext configuration can be exposed through permissive file permissions, workspace collection, backups, support archives, synchronization tools, or accidental sharing. Command-line arguments may also be visible to process-inspection utilities, monitoring agents, crash reports, diagnostic output, or logs, depending on the operating system and runtime configuration. The Auto-setup workflow adds a further exposure point because users are told to place the key directly into an agent prompt.

Attack Path

1. A user replaces <api_key> with a valid Destinia API key in the configuration or Auto-setup prompt.
2. The credential is persisted in plaintext and passed to mcp-remote as a command-line argument.
3. A local user, process-monitori ...[truncated 818 chars]

Remediation

View remediation

Remediation Suggestions

• Do not embed the API key directly in mcporter.json, agent prompts, or command-line arguments.
• Retrieve the credential at runtime from an operating-system keychain, managed secret store, or MCP client facility specifically designed for secret references.
• If environment variables are the only supported alternative, inject them through a protected launcher and ensure they are excluded from logs and diagnostic reports.
• Prefer transmitting the authorization header through standard input, a protected file descriptor, or another mechanism that does not expose it in the process argument list.
• Restrict any credential-bearing configuration file to its owner, such as mode 0600 on compatible systems.
• Exclude secret-bearing files from source control, synchronization, backups without access controls, and support bundles.
• Redact authorization headers and bearer tokens from process logs, error messages, telemetry, and prompt histories.
• Issue narrowly scoped, short-lived credentials where supported and document immediate revocation and rotation procedures after suspected disclosure.

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The auto-setup section instructs the agent to apply configuration that alters a local user-controlled mcporter/OpenClaw config file, but it does not clearly warn that persistent local configuration will be changed. This can lead to unintended system state changes, accidental trust in a new remote MCP server, and execution of future requests through that server without the user fully understanding the consequences.

Content

No source excerpt is available for this finding.