美团旅行助手

• Outcome: Review
• Latest audit: Jul 10, 2026 · 1:24 AM UTC
• Version: 2.0.3

Overview

The skill is a plausible travel-query helper, but its declared tools, documented interface, and executable script do not line up, while it sends user travel details to an external proxy.

Install only if you are comfortable sending city, destination, dates, budget, and other travel preferences to the skill’s external travel proxy. Before approving broader use, the publisher should align the declared tools with the actual script interface, document the real environment variables and proxy endpoint, and make the external data-sharing disclosure prominent.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Tainted flow: 'req' from os.environ.get (line 18, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

req.add_header("Content-Type", "application/json")
    req.add_header("X-Proxy-Token", PROXY_TOKEN)
    try:
        with urllib.request.urlopen(req, timeout=120) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            if data.get("code") == 0:
                return data.get("data", {})

• Confidence: 95% confidence
• Finding: with urllib.request.urlopen(req, timeout=120) as resp:

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares a proxy token environment dependency and describes sending user queries to an external travel data proxy, yet no explicit permissions are declared. This creates a transparency and governance gap: reviewers and users may not understand that network access and environment-backed credentials are involved, which can lead to unintended data exposure or under-reviewed outbound access.

Description-Behavior Mismatch

Medium

• Confidence: 84% confidence
• Finding: The manifest lists only hotel and scenic-search tools, while the documentation advertises flights, trains, and itinerary planning. This mismatch can mislead users and reviewers about the skill's actual behavior, increasing the risk that hidden or indirect tool behavior is invoked without adequate scrutiny.

Intent-Code Divergence

Medium

• Confidence: 90% confidence
• Finding: The documentation presents `local_travel_query` as the core interface, but no such tool is declared in the manifest. Undeclared interfaces are dangerous because they obscure the true execution path, making security review, policy enforcement, and user understanding of what is actually called much harder.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The activation wording is broad enough to overlap with many ordinary travel requests, which can cause the skill to trigger in situations where users did not intend to route their query through this external service. In this context, that matters because travel requests may include location, itinerary, and budget details that are then transmitted to a proxy/data provider.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The prominent user-facing description emphasizes zero-configuration convenience but does not clearly warn users up front that their travel queries are sent to an external proxy/data service. Because travel queries often contain sensitive contextual data such as current city, destination, dates, budgets, and preferences, the lack of early disclosure undermines informed consent and increases privacy risk.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The tool forwards user-supplied city and travel query data to an external proxy service without any code-level disclosure, consent flow, or minimization. Travel queries can contain sensitive itinerary, location, or booking-related information, so silent transmission to a third party creates a privacy and data-governance risk.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.