ClawHub
Back to skill

Security audit

全球酒店搜索与推荐

Security checks for vulnerabilities and agentic risk

Overview

This hotel-search skill uses a disclosed cloud proxy to fetch hotel results and does not show hidden persistence, destructive behavior, or unrelated data access.

Install only if you are comfortable sending hotel-search details, including destination, dates, query text, budget preferences, and possible family/occupancy information, through the skill’s cloud proxy. There is no evidence of hidden persistence or malicious behavior in the inspected artifacts.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (11)

Tainted flow: 'req' from os.environ.get (line 112, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Confidence
90% confidence
Finding

Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Content

Scanner excerpt · scripts/hotel_search_recommend.py (reported line 117)May include surrounding context.

python
headers={"Content-Type": "application/json", "X-Proxy-Token": PROXY_TOKEN},
        method="POST")
    try:
        with urllib.request.urlopen(req, timeout=timeout) as r:
            result = json.loads(r.read().decode("utf-8"))
        if result.get("code") != 0:
            return {"error": result.get("error", "proxy error")}

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High
Category
YARA Match
Confidence
80% confidence
Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · scripts/hotel_search_recommend.py (reported line 37)May include surrounding context.

python
��",
                 "赌场酒店", "临近商场", "宠物友好", "酒店主题特色",
                 "无障碍通道", "无障碍停车位"],
    "交通与支付": ["机场接送班车", "自行车租赁", "支持支付宝/微信", "支持银联卡"],
    "服务细节": ["中文服务", "中文标识"],
}

# ===== 场景配置 =====
SCENE_CONFIG = {
    "亲子": {
        "icon": "👨‍👩‍👧",
        "required": ["亲子酒店"],
        "preferred_sea": ["儿童乐园", "儿童泳池", "提供家庭房", "靠近海滩", "可提供婴儿床或围栏"],
        "preferred_inland": ["儿童乐园", "室内恒温泳池", "中式早餐", "提供家庭房", "可提供婴儿床或围栏"],
        "excluded": ["仅限成人入住"],
        "star": [3.5, 5.0],
        "default_nights": 2,
    },
    "商务": {
        "icon": "💼",
        "required": ["商务酒店"],
        "preferred_tier1": ["免费WiFi", "24小时前台", "健身房", "提供会议设施"],

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill declares network and environment-variable-backed tool capabilities but does not define explicit tool scope, permissions, or allowed-tools boundaries. This weakens least-privilege controls and makes it harder for users or the platform to understand exactly what external access the skill can exercise, especially since requests are routed through a proxy.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The markdown presents generic user utterances like '带娃去三亚住哪里好' and '三亚有什么便宜的酒店' as opening phrases, but does not define when the skill should activate versus when similar general travel chatter should not trigger it. This makes the activation scope overly broad for a manifest/markdown description and increases the chance of unintended invocation from ordinary conversation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The text states that cancellation rules are translated into plain Chinese ('白话中文'), which imposes a specific language behavior. There is no indication that the user can opt into another language or that the locale restriction is justified as a region-specific tool.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill sends user travel queries and search parameters through a cloud proxy and external hotel API, but the user-facing description does not provide a prominent, explicit warning before data leaves the local assistant context. This creates a transparency and privacy risk because users may unknowingly share itinerary details, destinations, dates, or family-travel information with third parties.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The top-level natural-language description presents the skill exclusively in Chinese and does not offer language selection or indicate that the tool is intentionally region-specific. Under the policy rule, forcing a specific language without user opt-in is a natural-language locale violation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill transmits user-provided query text, destination, dates, occupancy, and preference data to a remote third-party proxy service, but this file provides no user-facing disclosure, consent step, or minimization of sensitive travel data. In a travel assistant context, these details can reveal location plans, family composition, and budget preferences, creating a meaningful privacy risk if the proxy is operated externally or logs requests.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The argparse description and help strings are all presented in Chinese, which constrains interaction to a single language without presenting a user-selectable locale. This is a natural-language policy issue unless the tool is clearly documented as region- or language-specific.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The code reads a proxy authentication token from an environment variable, which is a credential-handling operation covered by the warning rule for code files. There is no accompanying comment or user-facing notice explaining that the skill uses an authentication token to contact an external service.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
95% confidence
Finding

L849 的注释表述为“覆盖全价位”，暗示不再按星级限制结果范围；但 L850-L851 只是把星级下限改为 0.0，仍然保留原有上限并继续按星级过滤。该注释会让维护者误以为这里移除了星级约束，和实际行为不一致。

Content

No source excerpt is available for this finding.