出境游旅行助手

• Outcome: Pass
• Latest audit: Sep 23, 2026 · 1:19 AM UTC
• Version: 1.0.19

Overview

This is a coherent Chinese-language travel assistant that uses disclosed remote lookup services for live travel data and does not show destructive, persistent, or deceptive behavior.

Install only if you are comfortable sending flight, hotel, seat, baggage, and hotel-detail queries to the skill's RG cloud proxy and currency codes to a public exchange-rate API. Avoid entering unnecessary personal details beyond the itinerary fields needed for a lookup.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            return data
    except urllib.error.HTTPError as e:

• Confidence: 92% confidence
• Finding: The proxy request target is taken from the RG_PROXY environment variable and used directly in urllib.request.urlopen, so deployment-time configuration can silently redirect all flight/hotel/seat/baggage queries and the attached bearer token to an arbitrary endpoint. In this skill’s context, those requests contain travel itinerary details and may include Authorization credentials, making SSRF-style misrouting, data exfiltration, or credential leakage plausible if the runtime environment is misconfigured or compromised.

Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

url = f"https://open.er-api.com/v6/latest/{from_currency.upper()}"
    try:
        req = urllib.request.Request(url)
        with urllib.request.urlopen(req, timeout=15) as resp:
            data = json.loads(resp.read().decode("utf-8"))
    except Exception as e:
        return json.dumps({"error": f"汇率查询失败: {e}"}, ensure_ascii=False)

• Confidence: 90% confidence
• Finding: Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill declares tools that rely on environment variables and remote network access, but it does not define an explicit tool scope such as permissions or allowed-tools. This can weaken least-privilege controls and make the skill's operational boundaries unclear to the host platform and users, increasing the chance of unintended tool or data access.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill discloses cloud proxy usage only later in the document under data flow, rather than warning users up front that flight, hotel, and related queries are transmitted to a remote proxy service. This creates a transparency and privacy issue because users may provide itinerary or location data before understanding where that data is sent.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: User-facing strings, help text, errors, disclaimers, and guidance throughout the file are presented in Chinese, with no mechanism to select another language. This imposes a locale/language constraint without opt-in or documented justification, which matches the language-policy violation criteria.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The travel search helpers forward user-supplied itinerary data such as origin, destination, dates, hotel city, and booking context to a remote proxy service, but the tool provides no clear user-facing notice or consent mechanism. In a travel assistant, itinerary metadata can be sensitive because it reveals movement plans and potentially identifiable travel behavior.

Natural-Language Policy Violations

Low

• Confidence: 91% confidence
• Finding: The manifest fields, examples, and all user-facing instructions are exclusively in Chinese, which effectively forces a specific language for interaction. Under the language/locale policy, this should either offer language choice or explicitly document that the skill is intended only for a Chinese-speaking audience.

Missing User Warnings

Low

• Confidence: 88% confidence
• Finding: The code reads PROXY_TOKEN from the environment and uses it as a Bearer token for outbound requests. There is no user-facing warning or explanatory comment indicating that the skill depends on and will use credentials from the runtime environment.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The function constructs a request to open.er-api.com and transmits the requested source currency to that external service. Although the data is limited, there is no visible disclosure in code comments, output, or documentation that this tool relies on an external network call.

Static analysis

No suspicious patterns detected.