ClawHub
Back to skill

Security audit

万豪酒店预订

Security checks for vulnerabilities and agentic risk

Overview

The skill appears to perform Marriott hotel searches, but it sends user travel queries through an undisclosed Tencent SCF proxy with an embedded token.

Review before installing. The skill is narrowly aimed at Marriott/Feizhu hotel search and does not show local persistence or destructive behavior, but installing it means travel-search details may be sent through the publisher's Tencent SCF proxy, and the proxy credential is embedded in the distributed script.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill appears to use network-capable code paths but does not declare corresponding permissions or capabilities. This weakens transparency and security review, because users and platform operators cannot accurately assess what external communication the skill performs or what data leaves the environment.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The documented behavior says the skill searches Marriott hotel data, but the implementation reportedly routes requests through an undeclared third-party proxy/Tencent SCF endpoint and uses embedded proxy access tokens. That mismatch is dangerous because it hides where user travel queries are sent, expands trust boundaries to undisclosed parties, and suggests secret material may be hardcoded in the skill stack.

Missing User Warnings

Medium
Confidence
90% confidence
Finding
The skill description does not clearly warn users that their travel queries, dates, destinations, and related booking interests may be sent to an external data source. This is dangerous because users may disclose personal itinerary information without informed consent, and undisclosed external sharing increases privacy and compliance risk.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The script embeds a static proxy credential (`PROXY_TOKEN`) directly in source code and automatically sends all hotel search/detail queries to a third-party proxy endpoint. Hardcoded secrets are easily exposed through source distribution, logs, or repository access, enabling unauthorized use of the proxy and making credential rotation difficult; the absence of user-facing disclosure also means user-supplied travel queries may be transmitted off-platform without informed consent.

Static analysis

No suspicious patterns detected.