ClawHub
Back to skill

Security audit

喜来登酒店查询与预订

Security checks across malware telemetry and agentic risk

Overview

This hotel-search skill is purpose-aligned overall, but it routes user travel queries through an under-specified proxy using an embedded shared token and an undeclared proxy URL setting.

Review before installing. The skill appears intended to provide hotel lookup results, not to damage files or take over accounts, but it sends travel-search data to a cloud proxy whose endpoint is not clearly declared and includes an embedded shared proxy token. Install only if you are comfortable with that proxy seeing your hotel destinations, dates, and query terms.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Tainted flow: 'req' from os.environ.get (line 26, credential/environment) → urllib.request.urlopen (network output)

Critical
Category
Data Flow
Content
method="POST",
    )
    try:
        resp = urllib.request.urlopen(req, timeout=timeout)
        data = json.loads(resp.read().decode("utf-8"))
        if data.get("status") == "error":
            return {"success": False, "error": data.get("message", "未知错误")}
Confidence
93% confidence
Finding
resp = urllib.request.urlopen(req, timeout=timeout)

Lp3

Medium
Category
MCP Least Privilege
Confidence
80% confidence
Finding
The skill advertises networked behavior and use of an environment-backed proxy token, yet no explicit permissions are declared. This creates a transparency and governance gap: reviewers and users cannot clearly see that the skill can make external requests and use sensitive configuration, which increases the risk of unnoticed data egress or misuse of credentials.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill claims to use direct official Fliggy data, but the finding indicates traffic is actually routed through an external proxy and even references a hardcoded default proxy token. That is dangerous because a proxy can observe, modify, or log user queries and results, and embedded credentials can be extracted and abused by anyone with access to the package.

Intent-Code Divergence

Medium
Confidence
78% confidence
Finding
The module claims Sheraton-only filtering, but get_sheraton_hotel_info accepts arbitrary shid or hotel_name and forwards it to the upstream Marriott detail API without verifying the returned hotel brand. This can cause the tool to return non-Sheraton properties, violating user expectations and weakening any policy or scoping assumptions built around the skill.

Missing User Warnings

Medium
Confidence
91% confidence
Finding
The code embeds a default proxy token in source via os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z"). A hardcoded credential can be extracted by anyone with code access and reused against the proxy service, and it also encourages insecure deployment patterns where production works with a shared secret checked into code.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.