Security audit

travel-master-v4-clawhub

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is not clearly malicious, but its real API/payment claims, forced multi-channel delivery, and background-start documentation need review before use.

Review this as a demo or incomplete integration before installing. Do not run the watchdog command unless the script is supplied and reviewed, use limited-scope API keys, avoid entering sensitive travel details unnecessarily, and manually verify any generated merchant or payment links before booking, paying, or sharing the output.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Rogue AgentSelf-Modification, Session Persistence
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (19)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill advertises operational capabilities that imply environment-variable access, MCP integration, and shell execution, yet it declares no permissions. This mismatch is dangerous because it can bypass user/admin expectations and enable execution paths or secret access that were not explicitly consented to or sandboxed.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The skill's documentation makes strong claims about real API calls, parallel merchant processing, and end-to-end HTML generation, while the underlying implementation is described as mock or static. This is risky because users and reviewers may trust it with real travel planning, credentials, or outbound actions under false assumptions, and the undocumented outbound-link behavior expands attack surface beyond the declared purpose.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The security section claims there is no subprocess usage, but the same document instructs operators to invoke CLI tools and persistent shell-based background processes. False security assurances are dangerous because they can cause reviewers to under-scope process-execution risk, which in turn can expose the host to command execution, persistence, and monitoring blind spots.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The file structure labels key components as mock implementations while the document simultaneously states that simulated data is forbidden and real APIs are mandatory. This inconsistency undermines trust and can lead users to rely on fabricated outputs for travel, booking, or cost decisions without understanding the data is not real.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The code claims there are no external jumps or network dependencies, yet it constructs real third-party URLs for Ctrip and Amap. Even without issuing HTTP requests itself, returning live outbound links can still send users to external services, creating a mismatch between the documented safety guarantees and actual behavior; in a travel-planning skill, this could mislead downstream systems or users into trusting links that were expected to remain local/mock-only.

Context-Inappropriate Capability

Medium

Confidence: 88% confidence
Finding: The generator embeds prominent outbound links for hotel booking, food ordering, ride hailing, and medicine purchasing directly into the produced HTML, expanding the skill from informational itinerary generation into transaction-oriented actions. In an agent context, this can steer users to third-party commercial flows without sufficient validation, disclosure, or consent controls, increasing phishing, dark-pattern, and unintended-purchase risk.

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The code and UI repeatedly claim that links and data are 'real' and directly usable, but the implementation mostly emits static links and simple query URLs rather than verified live booking/navigation/payment integrations. This mismatch can mislead users into over-trusting the generated guide, making social-engineering style persuasion more effective and increasing the chance of users acting on inaccurate or unverified information.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README explicitly describes collecting travel preferences and generating guides with parallel merchant links, implying outbound requests to multiple third-party services, but it provides no disclosure, consent flow, or privacy warning. In a travel-planning skill, user inputs can include dates, destinations, family composition, budget, transport preferences, and other sensitive behavioral data, so failing to warn users about external sharing increases privacy and trust risks.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The trigger phrase at line 56 is overly generic everyday language, which can cause the skill to activate in conversations that were not intended to invoke a travel-planning tool. In an agent ecosystem, broad activation increases prompt-surface exposure and can route unrelated user content into the skill, creating privacy, consent, and unintended-action risks.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger list includes generic planning and travel-related terms without clear scope boundaries, making accidental invocation more likely across normal conversation. Because this skill is designed to generate itineraries and aggregate external travel data, unintended activation expands exposure to user inputs and downstream integrations beyond what the user may expect.

Missing User Warnings

Medium

Confidence: 72% confidence
Finding: The engine reads a sensitive API key from the environment and initializes a real external-service client without any visible consent flow, disclosure, or guardrails around when user data may be sent to that provider. In a travel-planning skill, user prompts may contain itineraries, locations, or personal preferences, so silent third-party transmission creates a privacy and compliance risk even if the call path is not shown in this file.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger specification only says to list trigger words and does not require scoped activation criteria, disambiguation rules, or safety boundaries. In an agent skill ecosystem, overly broad triggers can cause unintended invocation on unrelated user input, which may execute external API calls or produce actions/content outside user intent.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The tutorial instructs users to create and edit a .env file with API keys but does not warn against committing, logging, screenshotting, or otherwise exposing those credentials. In a deployment guide for a travel-planning system that explicitly relies on multiple third-party APIs, omitted credential-handling guidance materially increases the risk of secret leakage, unauthorized API use, billing abuse, and downstream account compromise.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The UI explicitly advertises '真实支付' in the header without any visible warning, consent step, or explanation of what payment actions may occur. In a travel-planning skill, claims of real payment materially increase the risk of deceptive purchases, unexpected charges, or collection of sensitive financial data if users believe transactions can be initiated directly from the interface.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The initial bot message promises '真实导航和支付' and frames the skill as producing a closed-loop deliverable, but the UI provides no warning about external actions, data sharing, location use, or financial implications. Because this is a travel assistant context, users may reasonably interpret this as the skill being able to trigger real-world navigation or commerce, making the omission of disclosures and confirmations more dangerous.

Ssd 3

Medium

Confidence: 92% confidence
Finding: The engine explicitly preserves conversational memory and prior intent across messages, and only resets state when manually requested. In an agent skill context, this creates a real risk that one user's sensitive travel details, preferences, or prior conversation artifacts persist longer than expected and may influence or leak into later responses, especially if engine instances are reused across sessions.

Credential Access

High

Category: Privilege Escalation
Content: pip install flask python-dotenv aiohttp # 配置环境变量 cp .env.example .env nano .env # 填入真实API Key # 启动服务
Confidence: 84% confidence
Finding: The deployment instructions explicitly direct operators to create and populate a .env file with real API keys, indicating the skill depends on local secret material. In a skill that also implies shell/process capabilities and undeclared permissions, this raises the risk of credential exposure through logs, process environments, misconfigured file permissions, or unintended command access.

Credential Access

High

Category: Privilege Escalation
Content: # 配置环境变量 cp .env.example .env nano .env # 填入真实API Key # 启动服务 python3.8 main_v4_2.py
Confidence: 84% confidence
Finding: The instruction to manually edit .env with real API keys confirms operational handling of sensitive credentials by local users or deployers. In context, the danger is amplified by the surrounding shell-based deployment model and inaccurate safety claims, which can mask how easily secrets may be exposed or misused.

Session Persistence

Medium

Category: Rogue Agent
Content: ### 7.2 守护启动 ```bash nohup bash watchdog.sh > /tmp/watchdog.log 2>&1 & ``` ---
Confidence: 90% confidence
Finding: The documented use of nohup to launch a background watchdog creates persistence outside normal interactive supervision. This is risky in a skill context because long-lived background processes can continue accessing credentials, network resources, or logs after the initiating session ends, making abuse or misconfiguration harder to detect.

Static analysis

No suspicious patterns detected.