Security audit
Security checks for vulnerabilities and agentic risk
This skill is a coherent flight-status lookup tool that sends requested flight and airport queries to an external proxy, with some disclosure gaps but no hidden persistence, destructive behavior, or unrelated data access.
Install this only if you are comfortable sending flight numbers, routes, dates, and airport/weather queries to the listed external proxy service and managing the PROXY_TOKEN as a secret. The skill appears purpose-aligned, but its zero-configuration wording understates the token requirement and its broad weather/airport triggers may activate more often than expected.
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
)
try:
with urllib.request.urlopen(req, timeout=30) as resp:
result = json.loads(resp.read().decode('utf-8'))
# SCF代理返回格式：{"code": 0, "data": {飞常准原始响应}}
if result.get("code") == 0:
The skill declares access to a proxy token and describes a data flow through a proxy service and external API, but it does not define an explicit tool or permission scope. That creates unnecessary ambiguity about what network and environment access the runtime may use, increasing the chance of over-privileged execution or unintended external data access if the implementation changes or is abused.
The prompt, examples, and user-facing instructions are entirely in Chinese, which effectively forces a specific language experience. There is no indication that the skill is intentionally limited to Chinese-speaking users or that users may interact in another language.
The trigger patterns are broad enough to match common travel-related conversation, such as generic mentions of cities, flights, delays, or weather. This can cause unintended skill activation, leading to unnecessary external API calls, possible disclosure of user travel queries to third-party services, and tool use outside the user's clear intent.
The documentation materially misrepresents the security model by stating that the skill is zero-configuration with the API key hidden on the proxy side, while the implementation depends on a client-provided proxy token. Misleading security claims cause unsafe deployment assumptions and can result in secrets being distributed more broadly than intended.
The skill claims zero configuration and that credentials are hidden on the proxy, yet it requires a PROXY_TOKEN from the runtime environment. This creates a hidden secret dependency that can lead operators to provision and manage credentials unexpectedly, increasing the chance of misconfiguration, failed access, or insecure secret handling.
User-supplied travel data such as flight numbers, routes, dates, and airport queries are transmitted to a third-party remote proxy service without any explicit disclosure or consent mechanism. Even if the data is not highly sensitive in isolation, travel queries can reveal location, timing, and itinerary interests, and the hard-coded external proxy expands the trust boundary.
Natural-language strings throughout the script, including usage, errors, and output formatting, are exclusively in Chinese. There is no indication that the user can opt into another language or that the locale restriction is documented as an intentional region-specific constraint.
No suspicious patterns detected.