Security audit

上海迪士尼游园助手

Security checks across malware telemetry and agentic risk

Overview

This Shanghai Disney guide skill is mostly a disclosed, read-only park-planning helper, with some transparency and scoping issues users should be aware of.

Safe to install for read-only Shanghai Disney planning if you are comfortable with a cloud proxy being used for park-hours lookup. Treat queue times, show times, ticket prices, and route advice as estimates, verify official Disney sources before purchasing or visiting, and be aware the skill may suggest separate travel or hotel searches outside its own implemented tools.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (5)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill uses environment-backed network access via a proxy token but does not declare corresponding permissions, which reduces transparency and weakens review controls. Hidden or undeclared external access can expose user queries to third-party services and makes it harder for users or platforms to assess data handling risk.

Description-Behavior Mismatch

Medium

Confidence: 86% confidence
Finding: The route-planning and smart-recommendation outputs promote unrelated services such as train tickets, flights, hotels, and Shanghai food recommendations that are not described in the stated skill scope. In an agent context, this expands behavior beyond the declared manifest and can steer users or downstream agents into unintended actions or tool chains, creating a trust and capability-boundary violation.

Context-Inappropriate Capability

Medium

Confidence: 98% confidence
Finding: The script contains a hardcoded default proxy token, which is a credential-like secret embedded directly in code. Even if intended for convenience, embedded tokens can be extracted, reused by unauthorized parties, and make the skill dependent on an opaque external service not justified by a simple park-guide function.

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The sample trigger phrases are very broad and overlap with ordinary conversation, increasing the chance the skill is invoked unintentionally. Accidental activation can route unrelated user messages into the skill, causing unnecessary data processing or disclosure to the tool chain, especially where a network-backed schedule lookup exists.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill silently sends an authentication token to an external proxy on every schedule lookup, without any user-facing disclosure or consent. In an agent ecosystem, undisclosed authenticated outbound requests reduce transparency and can expose service access, usage patterns, or sensitive integration details to infrastructure outside the skill's stated scope.

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.