ClawHub
Back to skill

Security audit

途牛旅行助手

Security checks across malware telemetry and agentic risk

Overview

This travel-booking skill mostly matches its stated purpose, but it includes under-disclosed cancellation/order-detail actions and a hard-coded proxy token despite saying no key is embedded.

Review carefully before installing. Use this only if you trust the publisher and proxy service with travel-search data and booking personal information. Do not use cancellation/order-management features unless you can confirm the exact tool being invoked and the order affected. The publisher should remove the embedded fallback token, document every callable tool, and require explicit confirmation for cancellations.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Lp3

Medium
Category
MCP Least Privilege
Confidence
87% confidence
Finding
The skill declares no permissions while its documented behavior clearly relies on environment-variable access and outbound network requests. This creates a transparency and governance gap: reviewers and users may not realize the skill can transmit user data, including booking PII during ordering flows, to external services. The context increases risk because the skill explicitly supports reservation flows that involve names, phone numbers, and ID numbers.

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding
The documented purpose emphasizes travel search and booking, but static analysis indicates additional order-management capabilities such as flight cancellation, train-ticket cancellation, and train-order detail lookup. Undisclosed transactional actions are dangerous because they expand the skill's authority beyond what users and reviewers expect, enabling potentially destructive actions on user bookings without clear disclosure or consent boundaries. In this context, hidden cancellation functionality is especially sensitive because it can directly disrupt travel plans and may expose booking details.

Env Variable Harvesting

High
Category
Data Exfiltration
Content
]

PROXY_URL = os.environ.get("PROXY_URL", "")
PROXY_TOKEN = os.environ.get("PROXY_TOKEN", "tp_8k2mX9vQ4z")


def _validate_proxy_url(url):
Confidence
97% confidence
Finding
os.environ.get("PROXY_TOKEN

VirusTotal

62/62 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.