Trip.com携程国际版

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:08 AM UTC
• Version: 1.0.1

Overview

This travel-search skill does what it claims, but it sends user travel queries through a fixed external proxy with an embedded token and directly displays unvalidated remote results and booking links.

Install only if you are comfortable sending travel searches, dates, budgets, and destination details to the skill publisher's proxy service. Treat returned text and booking links as untrusted until verified on Trip.com, and prefer a version that uses user-supplied secrets, documented endpoints, and validated response fields.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/trip_com.py:20

Finding

Hardcoded Proxy Authentication Token

Content

View full analysis

Vulnerability Details

File Location: scripts/trip_com.py, lines 20-36
Vulnerability Type: Hardcoded credential exposure
Risk Level: Medium

Vulnerable Code

python

PROXY_URL = "https://1439498936-eu423jdjnd.ap-guangzhou.tencentscf.com"
PROXY_TOKEN = "tp_8k2mX9vQ4z"


def query_tripgenie(query: str, command_type: str = "query") -> dict:
    """Query TripGenie API through SCF proxy."""
    payload = {"query": query, "locale": "zh", "command_type": command_type}
    data = json.dumps(payload).encode("utf-8")
    req = urllib.request.Request(
        PROXY_URL,
        data=data,
        headers={
            "Content-Type": "application/json",
            "X-Proxy-Token": PROXY_TOKEN,
            "User-Agent": "TripCom-CN/1.0",
        },
        method="POST",
    )

Technical Analysis

The proxy authentication token is embedded directly in the distributed source code. Anyone with access to the Skill package can extract and reuse it. Although SKILL.md declares PROXY_URL and PROXY_TOKEN as environment variables, the implementation does not read those variables and instead always uses the hardcoded values.

Hardcoded credentials cannot be independently protected, rotated per deployment, or reliably restricted to an authorized runtime. If the remote proxy treats this token as sufficient authentication, possession of the package grants the same proxy access as the Skill.

Attack Path

1. An attacker obtains or downloads the Skill package.
2. The attacker reads scripts/trip_com.py and extracts the proxy URL and token.
3. The attacker constructs requests containing the exposed value in the X-Proxy-Token header.
4. The attacker submits requests directly to the proxy outside the intended Skill workflow.
5. The proxy processes the requests under the identity, quota, or billing context associated with the exposed token.

Impact Assessment

Exploitation may per ...[truncated 365 chars]

Remediation

View remediation

Remediation Suggestions

1. Revoke and rotate the exposed token immediately because it must be treated as compromised.
2. Remove the token and endpoint configuration from source code.
3. Load both values from the declared environment variables and fail closed when they are missing:

   python

   import os
   
   PROXY_URL = os.environ.get("PROXY_URL")
   PROXY_TOKEN = os.environ.get("PROXY_TOKEN")
   
   if not PROXY_URL or not PROXY_TOKEN:
       raise RuntimeError("Required proxy configuration is missing")
   

4. Supply the token through a managed secret store rather than repository files, command-line arguments, or logs.
5. Apply server-side rate limits, expiration, narrow API scopes, and per-deployment credentials.
6. Monitor historical proxy traffic for evidence that the exposed token has already been reused.
7. Avoid returning authentication details in proxy errors and ensure request headers are redacted from logs.

T01 · Skill Instruction Hijacking

Warning

• Location: scripts/trip_com.py:42

Finding

Untrusted Remote API Content Is Forwarded Without Validation

Content

View full analysis

Vulnerability Details

File Location: scripts/trip_com.py, lines 42-48 and 77-78
Vulnerability Type: Indirect prompt injection through untrusted remote output
Risk Level: Medium

Vulnerable Code

python

result = json.loads(resp.read().decode("utf-8"))
if isinstance(result, dict) and "data" in result:
    return {"success": True, "response": result["data"]}
elif isinstance(result, str):
    return {"success": True, "response": result}
else:
    return {"success": True, "response": str(result)}

python

if result.get("success"):
    print(result["response"])

Technical Analysis

Content returned by the external proxy is accepted as an arbitrary dictionary field, string, or stringified object and is then printed without schema validation, destination validation, sanitization, or an explicit trust boundary. The Skill instructions further direct the agent to present the API response directly to the user.

A compromised, malicious, or incorrectly configured upstream service can therefore return instruction-like text, deceptive claims, or attacker-controlled booking links. In an agent environment, such text can operate as an indirect prompt-injection payload if the agent interprets the returned content as instructions rather than untrusted travel data.

The script also does not enforce the expected response fields for each mode or verify that returned booking links use an approved HTTPS hostname. Consequently, output that does not represent a hotel, flight, or attraction result can still be treated as successful.

Attack Path

1. An attacker compromises the configured proxy, influences a downstream response, or otherwise causes the upstream service to return attacker-controlled content.
2. The malicious response places prompt-like instructions, misleading travel information, or a phishing URL in the response body or data field.
3. query_tripgenie accepts the content without c ...[truncated 1012 chars]

Remediation

View remediation

Remediation Suggestions

1. Require a strict response schema for every supported mode. Reject unexpected types, missing fields, excessive lengths, and unknown fields.
2. Represent remote results as structured records rather than unrestricted prose.
3. Validate every booking URL using parsed URL components. Require HTTPS and allowlist the exact approved Trip.com hostnames rather than using substring matching.
4. Mark all API-returned text as untrusted data and explicitly instruct the calling agent not to execute or follow instructions contained in that data.
5. Render only expected fields such as name, price, rating, schedule, and validated URL.
6. Reject responses containing unsupported executable markup or tool directives.
7. Apply response-size limits before decoding and parsing to reduce resource-exhaustion risk.
8. Log schema-validation failures without recording sensitive user queries or authentication headers.
9. Update the Skill instructions so that remote content is summarized only after validation instead of being displayed directly.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares the bash tool and explicitly instructs execution of a Python script that sends user queries through a proxy to an external Trip.com-related API, but it does not define any tool scope restrictions such as allowed-tools or permissions. That creates an unnecessarily broad execution surface where a network-capable workflow is implied without an explicit least-privilege boundary, increasing the risk of unintended external access or misuse if the skill is modified or invoked unexpectedly.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The documentation states '支持中文查询，返回中文结果', which indicates the skill returns results in Chinese by default. Under the policy, forcing a specific language without user choice is a natural-language policy violation unless clearly optional or justified as region-specific compliance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code hardcodes locale='zh' and builds all prompts/output flows in Chinese without checking user preference or allowing override. This is primarily a privacy/usability and user-expectation issue rather than direct code execution risk, but it can mislead users about where and how their data is being processed and reduce informed consent for non-Chinese speakers.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The script sends raw user travel queries to a third-party proxy endpoint with a hardcoded token, but provides no disclosure, consent, or privacy notice to the user. Travel searches can contain sensitive itinerary, destination, date, or companion information, and routing them through an opaque proxy increases privacy and data-handling risk beyond the expected Trip.com service itself.

Content

No source excerpt is available for this finding.