ClawHub
Back to skill

Security audit

丽思卡尔顿酒店查询与预订

Security checks across malware telemetry and agentic risk

Overview

This hotel-search skill appears purpose-aligned, but it needs Review because it sends queries through an unspecified proxy using an embedded token and overstates its data-source transparency.

Install only if you are comfortable sending hotel-search details to an unspecified proxy and downstream travel APIs. Treat prices and booking links as third-party results, and avoid entering sensitive itinerary details unless you trust the publisher and proxy configuration.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.environ.get (line 25, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        resp = urllib.request.urlopen(req, timeout=timeout)
        data = json.loads(resp.read().decode("utf-8"))
        if data.get("status") == "error":
            return {"success": False, "error": data.get("message", "未知错误")}
Confidence
91% confidence
Finding
resp = urllib.request.urlopen(req, timeout=timeout)

Lp3

Medium
Category
MCP Least Privilege
Confidence
85% confidence
Finding
The skill advertises zero configuration and declares no permissions, yet the analysis indicates environment and network capabilities are present. Undeclared capabilities reduce transparency and can hide external data flows or access to runtime secrets, making it harder for users and reviewers to assess what information may be exposed.

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding
The skill claims 'multiple travel-platform direct connections' and broad real-time coverage, but the underlying behavior appears to rely on a single proxy-backed Marriott/Fliggy source. This is a trust and integrity issue: users may make purchase decisions based on overstated coverage, redundancy, or source independence that does not actually exist.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill notes that query parameters are sent to an agent service and travel-platform APIs, but it does not clearly warn users that their travel search inputs may be shared with third parties. Travel queries can reveal sensitive itinerary or location preferences, so insufficient disclosure creates privacy and consent risks.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The code embeds a default proxy token and automatically uses it for authenticated outbound requests. Hardcoded credentials are easily reused, extracted, or unintentionally exposed, and users are not clearly informed that their queries are being sent through a token-authenticated third-party proxy.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.