ClawHub
Back to skill

Security audit

万怡酒店查询与预订

Security checks across malware telemetry and agentic risk

Overview

This hotel-search skill sends user hotel queries to a cloud proxy as part of its stated purpose, with no evidence of persistence, destructive behavior, or hidden local data access.

Install only if you are comfortable with hotel destinations, dates, hotel names, and keywords being sent to a cloud proxy and travel API provider. The skill does not appear malicious, but the proxy endpoint and token handling are not tightly documented or allowlisted.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        resp = urllib.request.urlopen(req, timeout=timeout)
        data = json.loads(resp.read().decode("utf-8"))
        if data.get("status") == "error":
            return {"success": False, "error": data.get("message", "未知错误")}
Confidence
96% confidence
Finding
resp = urllib.request.urlopen(req, timeout=timeout)

Missing User Warnings

Low
Confidence
73% confidence
Finding
The skill sends destination names, dates, hotel names, and related search criteria to an external proxy service, but the user-facing behavior does not disclose that this data leaves the local skill boundary. This is primarily a privacy and transparency issue rather than a direct exploit, but it can still expose travel plans and preferences to third parties.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# ===== 代理配置 =====
PROXY_URL = os.environ.get("PROXY_URL", "")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")


def _request(api_type, params, timeout=30):
Confidence
93% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.