ClawHub
Back to skill

Security audit

机票价格监控与比价

Security checks across malware telemetry and agentic risk

Overview

This flight-price skill is coherent with its stated purpose, but users should understand that searches are sent to external proxy services and same-price results may prefer commission links.

Install only if you are comfortable sending flight search details such as city pairs, dates, and optional target prices to the listed proxy services. Avoid setting PROXY_TOKEN to an unrelated personal or corporate secret, and be aware that same-price results may place commission-linked booking sources first.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (7)

Tainted flow: 'req' from os.environ.get (line 355, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
data = json.dumps(body, ensure_ascii=False).encode("utf-8")
    req = urllib.request.Request(url, data=data, headers=HEADERS, method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            return json.loads(r.read().decode("utf-8"))
    except urllib.error.HTTPError as e:
        return {"error": f"HTTP {e.code}", "detail": e.read().decode("utf-8", errors="replace")}
Confidence
90% confidence
Finding
with urllib.request.urlopen(req, timeout=timeout) as r:

Lp3

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding
Without declared permissions the skill's intent is opaque and cannot be validated.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding
整体上，这段代码的大部分功能与描述相符：它支持航线搜索、指定航班多平台比价、低价日历扫描，以及生成监控任务和价格分析建议。然而按照审计标准，只要存在未在描述中体现的重要能力就应判为不匹配。这里代码明确依赖并调用三个外部腾讯云SCF代理服务，且通过请求头发送代理令牌；这些外部服务访问与令牌使用并未在描述中说明。更重要的是，搜索和比价结果的排序含有“佣金优先级”偏置，这属于影响推荐结果的行为，和单纯“帮你比价”相比是未披露的附加行为。因此应判定为存在描述与实际行为不完全一致的情况。

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
The manifest describes a helper for price monitoring and multi-platform price comparison, which implies neutral comparison of fares. Here, when prices are equal or unavailable, the code explicitly applies a '佣金优先级' ordering that favors RG over 飞猪 over 途牛, introducing business-preference logic unrelated to the user's comparison intent.

Context-Inappropriate Capability

Medium
Confidence
97% confidence
Finding
For exact flight comparison, users would reasonably expect platforms to be ordered strictly by price or presented neutrally. The code instead sorts equal-price matches using a commission priority, which is not part of the declared purpose of precise multi-platform fare comparison.

Natural-Language Policy Violations

Medium
Confidence
91% confidence
Finding
This code file contains natural-language instructions and help text that assume Chinese as the only user language. Under the policy, forcing a specific language without user opt-in or a documented justification is a locale-policy violation.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# 配置
# ============================================================

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

# 代理地址
SCF_FLIGGY_URL = "https://1439498936-6sysdjjt99.ap-guangzhou.tencentscf.com"
Confidence
70% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.