Security audit

trip-scout

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is purpose-aligned, but it should be reviewed carefully because it handles, stores, and in one path logs account session cookies while also recommending mutable third-party package execution with tokens.

Install only if you are comfortable giving the skill access to travel-site sessions and API tokens. Use a dedicated low-privilege environment, avoid pasting high-value browser cookies, clear `~/.xiaohongshu/` and `~/.ctrip/` when done, protect those directories with owner-only permissions, and avoid the `@latest` Meituan command unless you pin and trust the package version.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: vendor/xhs_api/apis/xhs_pc_login_apis.py:414
Finding: Authentication Cookies and QR Login Material Exposed Through Logs
Content: View full analysis
Remediation: View remediation
" return f"{value[:3]}...{value[-3:]}" ``` 4. Do not rely solely on redaction at the logging sink. Prevent secrets from being passed to the logger in the first place. 5. Configure log retention and access controls so existing historical logs containing cookies are deleted or tightly restricted. 6. Invalidate sessions that may already have been recorded in logs. 7. Add automated tests that fail if keys such as `web_session`, `cookie`, `authorization`, QR tokens, or verification codes are passed to logging functions. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/xhs.py:65
Finding: Persistent Xiaohongshu Session Cookie Stored Without Explicit Permission Hardening
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: vendor/xhs_api/package.json:6
Finding: Mutable and Unlocked Runtime Dependencies Permit Post-Audit Supply-Chain Changes
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/dianping-research.md:89
Finding: Agent Instructions Execute an Unpinned Latest Package While Exposing an API Token
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: vendor/xhs_api/static/xhs_rap.js:420
Finding: Opaque Embedded Bytecode Is Decoded and Executed by a Custom JavaScript Virtual Machine
Content: View full analysis
> 4, k = (15 & H) << 4 | I >> 2, w = (3 & I) << 6 | c; C.push(String.fromCharCode(J)); 64 != I && C.push(String.fromCharCode(k)); 64 != c && C.push(String.fromCharCode(w)); } return /* UTF-8 decoding logic */ (C.join("")) })(E.b).split("").reduce(function(B, Q) { (!B.length || 5 == B[B.length - 1].length) && B.push([]); B[B.length - 1].push(-1 + Q.charCodeAt()); return B }, []), ``` The decoded instruction sequence is then executed: ```javascript return _garp_2846(y) ``` The embedded module is initialized and exposed through a signing wrapper: ```javascript if (!window.__xhsRapModuleFactory) throw new Error('x-rap module not found'); window.__xhsRapModuleFactory(); window.__flushRapTimers(); function generate_x_rap_param(api, data, appId) { window.__capturedRapParam = null; // signing invocation window.__flushRapTimers(); if (!window.__capturedRapParam) throw new Error('x-rap-param not generated'); return window.__capturedRapParam; } ``` ### Technical Analysis The file embeds a large ...[truncated 2536 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (306)

Context-Inappropriate Capability

Critical

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The bundle retrieves anti-spam scripting from a remote endpoint and executes it dynamically, effectively giving an external service code-execution control inside the page context. If that endpoint, path, or trust chain is compromised, an attacker can run arbitrary JavaScript, access page data, invoke bridges, and exfiltrate sensitive information.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: Xiaohongshu request-signing logic that parses cookies, uses session values like a1, and computes anti-bot headers is a sensitive hidden capability well outside normal travel planning. It makes the skill more dangerous because the benign context can mask authenticated scraping behavior and opaque handling of user session material.
Content: No source excerpt is available for this finding.

Static analysis

Detected: suspicious.dynamic_code_execution, suspicious.env_credential_access

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: vendor/xhs_api/static/xhs_xray_pack2.js:3443

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: vendor/xhs_api/static/xhs_xray.js:207

Environment variable access combined with network send.

Critical

Code: suspicious.env_credential_access
Location: vendor/xhs_api/static/xhs_xray_pack1.js:35836