Security audit

TripGenie

Security checks for vulnerabilities and agentic risk

Overview

TripGenie is a disclosed travel API skill that sends travel queries and optional flight details to Trip.com, with no hidden persistence or local system changes found.

Install only if you are comfortable sending travel questions, itinerary details, and an API token to Trip.com. Prefer TRIPGENIE_API_KEY over pasting keys into chat, avoid including unnecessary personal details in prompts, and disable or limit automatic invocation if you want case-by-case control.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The description 'Use for any travel question' is an overly broad invocation trigger that can cause the agent to send a wide range of user travel-related prompts to a third-party service automatically. Because travel queries often contain personal itinerary details, locations, dates, and preferences, broad matching increases the chance of unnecessary external data disclosure.

External Transmission

Medium

Category: Data Exfiltration
Content: ```bash # The 'locale' argument is optional and can be omitted if not provided by the user. jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" '{token: $token, query: $query}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/query -H "Content-Type: application/json" -d @- ``` ### Flight Search (`/openclaw/airline`)
Confidence: 81% confidence
Finding: This command transmits user-provided query data and an authentication token to an external Trip.com endpoint. Although this is the skill's intended function, it is still a real security/privacy concern because user travel requests may contain sensitive personal data, and broad invocation increases the likelihood of sending more data than necessary to a third party.

External Transmission

Medium

Category: Data Exfiltration
Content: **Domestic flight example:** ```bash jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" --arg departure "BJS" --arg arrival "SHA" --arg date "2026-03-15" --arg flight_type "1" '{token: $token, query: $query, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- ``` **International flight example:**
Confidence: 84% confidence
Finding: This flight search example sends detailed itinerary information including departure, arrival, and date to an external service along with the API token. Travel itinerary data is sensitive and can reveal location patterns, making external transmission a meaningful privacy exposure even if the endpoint is legitimate.

External Transmission

Medium

Category: Data Exfiltration
Content: **International flight example:** ```bash jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" --arg departure "FRA" --arg arrival "HKG" --arg date "2026-03-17" --arg flight_type "0" '{token: $token, query: $query, departure: $departure, arrival: $arrival, date: $date, flight_type: $flight_type}' | curl -s -X POST https://tripgenie-openclaw-prod.trip.com/openclaw/airline -H "Content-Type: application/json" -d @- ``` ## Presenting results to the user
Confidence: 84% confidence
Finding: This second airline example has the same issue: it transmits sensitive travel search details and a credential to an external provider. International itinerary information can be especially sensitive because it may expose future travel plans and cross-border movements to a third party.

Static analysis

No suspicious patterns detected.