ClawHub
Back to skill

Security audit

TripAI

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed Ctrip travel-query skill that sends travel requests to Ctrip and can optionally use a locally stored API key.

Install only if you are comfortable sending travel questions to Ctrip's service. Prefer using TRIPAI_API_KEY as an environment variable for short sessions, or set restrictive file permissions if storing the key locally; do not include passwords, payment data, or unrelated private information in travel queries.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Rogue AgentSelf-Modification, Session Persistence
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
jq -n --arg token "$TRIPAI_API_KEY" --arg query "$USER_QUERY" \
  'if $token != "" then {token: $token, query: $query, source: "clawhub"} else {query: $query, source: "clawhub"} end' \
  | curl -s -X POST https://wendao-skill-prod.ctrip.com/skill/query -H "Content-Type: application/json" -d @-
```

**参数说明**
Confidence
93% confidence
Finding
The skill sends the full user query, and optionally an API token, to an external Ctrip endpoint via curl. This creates a real data exfiltration surface because user-supplied travel requests may contain sensitive personal or itinerary information, and the skill does not show any consent gating, minimization, or warning before transmitting data off-platform.

Session Persistence

Medium
Category
Rogue Agent
Content
**方式 A — 配置文件（推荐）：**

```bash
mkdir -p ~/.config/tripai-skill
echo "your_api_key" > ~/.config/tripai-skill/api_key
```
Confidence
89% confidence
Finding
The skill recommends persisting the API key in a plaintext file under ~/.config/tripai-skill/api_key and later reads it automatically for requests. Storing long-lived credentials unencrypted on disk increases the chance of credential disclosure through local compromise, backups, misconfigured permissions, or unintended sharing across sessions.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.