ClawHub
Back to skill

Security audit

景点门票比价

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed travel-ticket comparison tool that sends attraction search terms to its proxy APIs, with one credential-handling issue users should understand.

Install only if you are comfortable sending attraction names, cities, and ticket-search parameters to the skill's proxy services and downstream travel platforms. The publisher should remove and rotate the hardcoded fallback proxy token, but the observed behavior is otherwise purpose-aligned.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding
The skill declares access to an environment token (PROXY_TOKEN) and clearly performs outbound network calls to multiple third-party travel platforms, but no explicit permissions are declared. This creates a transparency and governance gap: the host or user may not understand that the skill can exfiltrate query data to external services or use sensitive environment-backed credentials for network access.

Context-Inappropriate Capability

Medium
Confidence
94% confidence
Finding
The code contains a hardcoded default proxy token and also reads a proxy credential from the environment, which means a live credential may be embedded in distributed source and reused by anyone with code access. In this skill context, backend access tokens are not necessary to expose in code and could allow unauthorized use of the proxy infrastructure or abuse billed backend resources.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# 配置
# ============================================================

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

SCF_FLIGGY_URL = "https://1439498936-6sysdjjt99.ap-guangzhou.tencentscf.com"
SCF_TUNIU_URL = "https://1439498936-0junm3maxj.ap-guangzhou.tencentscf.com"
Confidence
97% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.