TripAI

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:31 AM UTC
• Version: 1.0.5

Overview

The skill appears to be a legitimate Ctrip travel-query integration, but it persists an API key in plaintext and sends user queries to an external service.

Review this before installing if you plan to use an API key or include personal travel details. Prefer using a temporary environment variable, avoid placing sensitive personal information in free-form queries, and if you use the config file, restrict it to owner-only permissions and rotate the token if it may have been exposed.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:93

Finding

API Token Stored in a Plaintext File Without Enforced Access Permissions

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 93–96 and 108–114
Vulnerability Type: Plaintext sensitive-data storage with environment-dependent file permissions
Risk Level: Medium

Vulnerable Code

Lines 93–96:

bash

mkdir -p ~/.config/tripai-skill
echo "your_api_key" > ~/.config/tripai-skill/api_key

Lines 108–114:

bash

if [ -n "$TRIPAI_API_KEY" ]; then
  mkdir -p ~/.config/tripai-skill
  echo "$TRIPAI_API_KEY" > ~/.config/tripai-skill/api_key
fi
TRIPAI_API_KEY="$(cat ~/.config/tripai-skill/api_key 2>/dev/null)"

Technical Analysis

The documented setup and execution process stores TRIPAI_API_KEY as plaintext in ~/.config/tripai-skill/api_key. Neither the containing directory nor the credential file is assigned an explicit restrictive permission mode.

The resulting permissions therefore depend on the user's current umask, pre-existing directory permissions, and whether the destination file already exists. In a shared or incorrectly configured environment, another local user or process may be able to read the token. Redirecting with > truncates or creates the file but does not securely correct the permissions of an existing file.

The usage instructions also automatically persist a token supplied through the environment. This expands the token's lifetime from the current process environment to persistent storage without an explicit user decision at execution time.

Attack Path

1. A user exports a valid Ctrip API token through TRIPAI_API_KEY.
2. The documented command writes the token to ~/.config/tripai-skill/api_key.
3. The file inherits environment-dependent permissions, or retains unsafe permissions if it already exists.
4. A local user or process with access to the file reads the plaintext token.
5. The attacker submits requests to the Ctrip skill endpoint using the stolen token.

Exploitation requires local access to the victim's environm ...[truncated 706 chars]

Remediation

View remediation

Remediation Suggestions

• Create the credential directory with owner-only permissions:

  bash

  mkdir -p ~/.config/tripai-skill
  chmod 700 ~/.config/tripai-skill
  

• Create or normalize the credential file with mode 600 before writing the token:

  bash

  install -m 600 /dev/null ~/.config/tripai-skill/api_key
  printf '%s\n' "$TRIPAI_API_KEY" > ~/.config/tripai-skill/api_key
  

• Use printf instead of echo to avoid implementation-specific handling of token values beginning with options or containing escape sequences.

• Do not automatically persist an environment-provided token during every invocation. Use the environment value directly and read the file only as a fallback.

• Prefer an operating-system credential manager or secret store where available.

• Validate existing credential-file ownership and permissions before reading it. Reject files owned by another user or accessible by group and other users.

• Document token revocation and rotation procedures for users who suspect local disclosure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description says the skill is especially good at handling complex, colloquial Chinese travel queries, which creates a strong language-specific expectation. The file does not offer users a language choice or explicitly justify that the skill is limited to Chinese-only operation as a region-specific tool.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate finding points to the same plaintext credential persistence behavior: storing the API key in ~/.config/tripai-skill/api_key. Even though the intent appears operational convenience, persistent plaintext secrets increase the chance of credential leakage through local compromise or improper file permissions.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

方式 A — 配置文件（推荐）：

bash

mkdir -p ~/.config/tripai-skill
echo "your_api_key" > ~/.config/tripai-skill/api_key

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

This duplicate finding points to the same plaintext credential persistence behavior: storing the API key in ~/.config/tripai-skill/api_key. Even though the intent appears operational convenience, persistent plaintext secrets increase the chance of credential leakage through local compromise or improper file permissions.

Content

Scanner excerpt · SKILL.md (reported line 95)May include surrounding context.

方式 A — 配置文件(推荐):

bash

mkdir -p ~/.config/tripai-skill
echo "your_api_key" > ~/.config/tripai-skill/api_key

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

The skill sends user-provided travel queries, and optionally an API token, to an external third-party endpoint using curl. This creates a real data egress path: sensitive itinerary details, personal preferences, or embedded secrets in USER_QUERY could be transmitted off-platform, and the skill does not document consent, minimization, or filtering safeguards.

Content

Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.

bash

jq -n --arg token "$TRIPAI_API_KEY" --arg query "$USER_QUERY" \
  'if $token != "" then {token: $token, query: $query, source: "clawhub"} else {query: $query, source: "clawhub"} end' \
  | curl -s -X POST https://wendao-skill-prod.ctrip.com/skill/query -H "Content-Type: application/json" -d @-

参数说明

Static analysis

No suspicious patterns detected.