ClawHub
Back to skill

Security audit

出境游旅行助手

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent travel assistant, but its live search features send travel query details to external services and rely on a shared embedded proxy token.

Install only if you are comfortable sending flight, hotel, and exchange-rate queries to external services. Avoid entering highly sensitive itinerary details unless necessary, and treat the built-in proxy token and retention claim as something the publisher should improve or clarify.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (6)

Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        with urllib.request.urlopen(req, timeout=30) as resp:
            data = json.loads(resp.read().decode("utf-8"))
            return data
    except urllib.error.HTTPError as e:
Confidence
93% confidence
Finding
with urllib.request.urlopen(req, timeout=30) as resp:

Lp3

Medium
Category
MCP Least Privilege
Confidence
92% confidence
Finding
The skill documents use of environment variables and networked services (cloud proxy and public API), but does not declare corresponding permissions or clearly scope those capabilities. This can mislead users and reviewers about what data leaves the local environment, reducing informed consent and weakening platform security controls.

Intent-Code Divergence

Low
Confidence
84% confidence
Finding
Several tools are described as local or not requiring a token, yet the skill also broadly documents a proxy-based data flow and exposes a PROXY_TOKEN env variable for every tool. This inconsistency can cause users or integrators to incorrectly assume no external transmission occurs, leading to accidental disclosure of travel queries or metadata.

Missing User Warnings

Medium
Confidence
94% confidence
Finding
The skill lacks a prominent privacy warning that flight/hotel searches are sent through a cloud proxy and exchange-rate requests go to a public API. Users may submit itinerary, destination, and timing information without realizing it is shared externally, which can expose sensitive travel patterns and personal context.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill transmits user-supplied travel details such as origin, destination, dates, hotel searches, and booking-related identifiers to an external proxy service without any user-facing notice or consent boundary. While not code-execution dangerous, this is a real privacy/security issue because travel data is sensitive and can reveal location plans and personal behavior.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
import urllib.error

PROXY_URL = os.environ.get("RG_PROXY", "https://1439498936-460a7b6oqn.ap-guangzhou.tencentscf.com")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

# ============================================================
# 第一组：RG代理工具 (5个)
Confidence
98% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.