ClawHub
Back to skill

Security audit

机票聪明买

Security checks across malware telemetry and agentic risk

Overview

The skill is mostly a disclosed flight-search proxy tool, but it embeds a proxy token while claiming the source has no hardcoded secrets.

Review before installing. This skill sends flight search details such as route and date to the publisher's proxy service, which is expected for live pricing. The main issue is that the script contains a shared fallback proxy token despite claiming no hardcoded secrets, so users should treat the proxy trust boundary and credential handling as under-disclosed.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)

Lp3

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding
The skill declares no permissions while its documented behavior includes reading an environment variable (PROXY_TOKEN) and sending user query data over the network to a proxy service and downstream travel APIs. This undermines transparency and host-side policy enforcement, because users and the platform cannot accurately assess what capabilities the skill needs before invocation.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding
The skill description says 'multi-platform direct connection' and frames monitoring as a built-in capability, but the actual behavior relies on an external proxy/token model and only emits monitoring tasks for the host to run. Description-behavior mismatch is dangerous because it conceals the true trust boundary, where user travel queries are sent, and what operational actions are really performed, increasing the risk of undisclosed data sharing and misleading user consent.

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill embeds a default proxy token and automatically uses it for outbound requests to third-party cloud functions. A hardcoded fallback credential can be abused by anyone with source access, enables unauthorized use of the proxy service, and weakens accountability because requests may run under a shared secret unrelated to a specific user or deployment.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill transmits user itinerary details such as origin, destination, and travel date to external endpoints without any executable-path disclosure or consent mechanism. While this is functionally related to flight search, the lack of transparency increases privacy risk, especially because the destinations are remote proxy services outside the user's immediate visibility.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
# 配置
# ============================================================

PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")

# 代理地址
SCF_FLIGGY_URL = "https://1439498936-6sysdjjt99.ap-guangzhou.tencentscf.com"
Confidence
97% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.