Security audit

酒店比价

Security checks across malware telemetry and agentic risk

Overview

This hotel-price skill mostly does what it claims, but it ships a backend proxy token and uses monetized/tracked booking behavior that is not fully disclosed to users.

Install only if you are comfortable sending hotel searches and travel dates through the publisher's Tencent Cloud proxy and OTA providers. Treat booking links as potentially monetized or tracked, and do not enter sensitive itinerary details unless you trust the publisher's proxy handling. The main risk is transparency and backend-token exposure, not local file access or destructive behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 91% confidence
Finding: The skill declares and relies on outbound network behavior through a cloud proxy and multiple OTA platforms, but no explicit permission declaration is present. This weakens transparency and reviewability, making it harder for users or platform enforcement to understand that user queries and travel parameters are sent to external services.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The skill description suggests broad five-platform comparison from the outset, but the document admits the browse phase is mainly single-source and later includes booking links plus commission-prioritized recommendation behavior. Undisclosed affiliate or commission-based routing creates a trust and integrity problem because users may believe results are unbiased lowest-price recommendations when ranking can be influenced by monetization.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The script hard-codes a proxy endpoint and authentication token directly in source, giving anyone with code access reusable credentialed access to the backend proxy service. Because that proxy mediates requests to multiple external travel sources, token leakage can enable unauthorized use, quota abuse, data exfiltration, and billing or reputation damage beyond normal client-side hotel search behavior.

Description-Behavior Mismatch

High

Confidence: 93% confidence
Finding: The `COMMISSION_PRIORITY` map is used as a secondary sort key when prices are equal, meaning affiliate-preferred sources are surfaced first while the skill claims neutral whole-network lowest-price comparison. This is a trust and integrity issue: users may be steered toward monetized links without clear disclosure, undermining the accuracy of the skill's recommendation logic.

Intent-Code Divergence

High

Confidence: 95% confidence
Finding: The code comment explicitly states that Fliggy links are promoter short links with commission tracking, which conflicts with the product description's neutral price-comparison framing. This indicates undisclosed monetized redirection and user click tracking, creating a deceptive behavior and privacy/transparency risk rather than a purely functional comparison tool.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The proxy request function sends user-provided city, dates, hotel names, keywords, and POI data to an external proxy service and downstream platforms, but the code shows no user-facing notice, consent flow, or minimization. Travel search data can reveal sensitive itinerary information, and routing it through a third-party proxy increases privacy and handling risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The embedded proxy credential is not only hard-coded but also silently used for external service access without any disclosure that a credentialed intermediary is involved. This hides the true data flow and trust boundary from users, who may believe the skill performs simple direct comparison rather than brokered access via a privileged external service.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.