Security audit

全球酒店搜索与推荐

Security checks for vulnerabilities and agentic risk

Overview

This hotel search skill does what it advertises, but it routes travel queries through a fixed cloud proxy with an embedded token and limited user control or disclosure.

Review before installing. The skill appears non-destructive and purpose-aligned, but users should understand that hotel searches, dates, occupancy, and free-text travel details are sent to a fixed third-party cloud proxy using an embedded token.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 81% confidence
Finding: The skill declares no permissions while its documented data flow clearly sends user queries to a cloud proxy and external hotel API, which is a network capability with privacy and trust implications. Even in a markdown-defined skill, failing to declare or surface this capability can mislead reviewers and users about where their travel data is sent.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 88% confidence
Finding: The finding indicates behavior beyond the stated purpose: requests are routed through an external proxy and reportedly rely on hardcoded remote proxy details and an access token. Hidden intermediaries and embedded credentials increase the risk of undisclosed data sharing, service impersonation, token leakage, and loss of operator control over where sensitive travel queries are processed.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The skill hard-codes a live proxy endpoint and bearer-like token directly in source, which exposes reusable credentials to anyone with code access and enables unauthorized use of the backend proxy. In this context the proxy is the mechanism for all hotel search/detail calls, so compromise could lead to service abuse, quota theft, billing exposure, and access to user itinerary queries sent through that proxy.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill says data flows through a cloud proxy and external hotel API, but it does not present this as a clear user-facing warning at the point of use. Users may share itineraries, destinations, family composition, and dates without informed consent about third-party processing, creating privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill transmits user queries, destination, dates, occupancy, and related trip details to an external proxy service without any consent, disclosure, or data-minimization controls. Travel itinerary data can be sensitive, and routing it through a third-party proxy increases privacy risk, especially since the proxy is custom rather than a clearly documented first-party API.

Static analysis

No suspicious patterns detected.