T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:543- Finding
Mandatory Verbatim Output Enables Stable Promotional Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
同程程心 Tongcheng Chengxin Travel Search
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent travel-search integration, but it should be reviewed because it forces verbatim output of remote travel content and links that are not safely validated.
Install only if you are comfortable sending travel queries and optional trip details to Tongcheng's API and seeing provider booking links/promotional guidance. Treat returned UGC text and links as untrusted: verify destination domains before clicking, and avoid entering sensitive personal details in free-text queries.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T01 · Skill Instruction Hijacking
Error
- Location
scripts/travel-query.js:210- Finding
Untrusted API-Supplied UGC Is Injected Directly into Mandatory Agent Output
- Content
View full analysis
{ const name = ugc.name || '无标题'; const author = ugc.nickName || '匿名用户'; const city_name = ugc.cityName || ''; const scenery_list = (ugc.sceneryNameList || []).filter(s => s && s !== '-'); const topic = ugc.topic || ''; const raw_content = ugc.ugcContent || ''; const content_summary = raw_content.length > CONTENT_SUMMARY_LIMIT ? raw_content.substring(0, CONTENT_SUMMARY_LIMIT) + '…' : raw_content; const redirect_url = ugc.redirectUrl || '#'; output += `${idx + 1}. **${name}** - ${author}\n`; if (city_name) { output += ` 📍 城市：${city_name}\n`; } if (scenery_list.length > 0) { output += ` 🏞️ 涉及景区：${scenery_list.join('、')}\n`; } if (topic) { output += ` 🏷️ 话题：${topic}\n`; } if (content_summary) { output += ` 📄 内容摘要：${content_summary}\n`; } output += ` 🔗 [查看全文](${redirect_url})\n\n`; }); output += '💡 以上攻略由真实用户分享，以下内容可作为你制定行程的参考。\n\n'; return output; ``` ### Technical Analysis The `ugcContent`, title, author, topic, city, scenery names, and redirect URL originate in an external API response. These fields are interpolated directly into Markdown output. The only restriction on `ugcContent` is a 2,000-character truncation limit. The code does not: - Escape Markdown syntax. - Neutralize role-like or instruction-like content. - Delimit the content as untrusted quoted data. - Detect prompt-injection phrases. - Remove embedded links, images, or deceptive formatting. This becomes particularly ...[truncated 1632 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/lib/formatters.js:14- Finding
Booking and UGC Links Are Rendered Without HTTPS or Domain Allowlisting
- Content
View full analysis
CONTENT_SUMMARY_LIMIT ? raw_content.substring(0, CONTENT_SUMMARY_LIMIT) + '…' : raw_content; const redirect_url = ugc.redirectUrl || '#'; output += `${idx + 1}. **${name}** - ${author}\n`; if (city_name) { output += ` 📍 城市：${city_name}\n`; } if (scenery_list.length > 0) { output += ` 🏞️ 涉及景区：${scenery_list.join('、')}\n`; ...[truncated 2162 chars]- Remediation
View remediation
Vulnerability Patterns
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (50)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
代码文件名和内部注释都明确表明这是“机票专用查询 API”。参数验证仅允许三类机票查询组合：出发地+目的地、航班号、出发地+低价；API 路径也是 /flightResource。结果处理函数只处理 flightDataList/flightList，并调用机票格式化函数。虽然补充了前往/离开机场的火车/汽车推荐，但这是机票场景的辅助信息，不构成其已实现综合在线搜索能力。由于声明描述的是广泛的旅游搜索 skill，而所给代码片段的实际主功能明显缩窄为机票查询，且缺失多个核心已声明类别，因此描述与代码行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 94% confidence
- Finding
The description presents a general-purpose travel search skill spanning many travel domains. However, the provided code chunk is narrowly scoped to hotel queries only: it uses a hotel-specific API path, requires a destination city, and formats hotel result lists. There is no evidence in this chunk of flight, rail, vacation, guide, itinerary, bus, scenic spot, or ticket search functionality. This is a material scope mismatch between the declared purpose and the actual behavior of the supplied code chunk.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
代码文件明确是“景点专用查询 API”，固定调用景区资源路径 /sceneryResource，参数也围绕 destination 和 extra 展开，结果处理仅针对 sceneryDataList/sceneryList 并使用景区格式化函数输出。因此，该代码块的实际主用途是景区查询，而不是声明中的广泛旅游搜索能力全集。虽然景区查询属于声明范围的一部分，但声明描述明显比实际代码能力宽得多，足以构成描述与行为不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
声明描述的是一个广泛的在线旅游搜索技能，覆盖多类旅游产品与服务；但提供的代码块仅是 traffic-query.js，功能集中在交通资源查询，且优先用于用户未明确指定交通方式时返回火车、机票、汽车票和公交地铁路线。其主要目的比声明窄得多，未见酒店、度假、攻略、景区、门票、综合行程规划或预订页跳转实现。因此描述与该代码块的实际行为存在明显不一致。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
描述强调的是综合在线旅游搜索能力，而该代码块的主功能明显是“火车票专用查询 API”。它限定请求路径为 /trainResource，参数也全部围绕火车票查询场景设计，结果处理逻辑仅针对 trainDataList、直达/中转车次和往返提示。虽然火车票属于描述中的一个子集，但声明的核心范围远大于实际代码能力，属于明显的能力范围不符。未发现额外敏感或越权行为；问题在于描述显著高于代码实际实现范围。
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md | **度假产品 / 跟团游 / 自由行 / 行程规划** | "云南旅游团"、"三亚自由行"、"帮我规划北京三日游"、"从苏州出发到杭州玩三天" | **`travel-query.js`** |
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如对查询文本中的个人信息有顾虑，请避免输入敏感信息，或直接查看 `scripts/lib/api-client.js`（网络调用）和 `scripts/lib/query-response.js`（响应处理）以确认数据流向。
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 79% confidence
- Finding
The skill declares an environment variable requirement (
CHENGXIN_API_KEY) but does not define any explicit tool scope such aspermissionsorallowed-tools. In practice this can lead to overbroad runtime access, making it unclear whether the skill is authorized to read only the intended credential or potentially other environment data if the host framework defaults are permissive.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill description and all user-facing instructions are written exclusively in Chinese, and the branding/name also target a Chinese-language experience. The file does not indicate that users may choose another language or that the Chinese-only behavior is a documented, justified locale restriction, which can violate language-choice policy.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file title and description are entirely in Chinese, presenting the API reference in a single language with no indication that users may choose another language or locale. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified.
- Content