携程问道 - AI Travel Assistant

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:40 AM UTC
• Version: 1.0.1

Overview

This travel skill is a coherent Ctrip API wrapper, but users should understand that their travel queries and API token are sent to Ctrip and responses are written to a fixed temporary file.

Before installing, confirm you are comfortable sending travel queries and the Wendao API token to Ctrip. Prefer configuring the token as WENDAO_API_KEY instead of pasting it into chat. On shared systems, avoid the documented fixed /tmp output file pattern; display the curl response directly or use a unique restricted temporary file and clean it up.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43

Finding

Predictable Temporary File Allows Local File Overwrite and Data Exposure

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 43–45
Vulnerability Type: Unsafe temporary-file handling
Risk Level: Medium

Vulnerable Code

bash

jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" '{token: $token, query: $query}' | curl -s -X POST https://wendao-skill-prod.ctrip.com/skill/query -H "Content-Type: application/json" -d @- > /tmp/wendao-result.md
cat /tmp/wendao-result.md

Technical Analysis

The documented command writes the remote API response to the fixed and predictable path /tmp/wendao-result.md using ordinary shell redirection. It does not securely create the file, check its ownership or type, enforce restrictive permissions, or remove it afterward.

On systems where /tmp is shared among users, another local user can pre-create this path as a symbolic link. Shell redirection will normally follow that link and truncate the linked destination if the skill's process has permission to write it. Concurrent invocations can also overwrite or read one another's results. In addition, the response—which may contain user travel queries, itineraries, booking recommendations, or other contextual information—can remain on disk after execution.

The API token is passed in the request body through a pipe and is not written to this result file by the shown command. The confirmed exposure concerns the API response and the unsafe file-write primitive, not direct token persistence.

Attack Path

1. An attacker with local access predicts the documented output path /tmp/wendao-result.md.
2. Before the skill runs, the attacker creates that path as a symbolic link to another file writable by the account executing the skill.
3. The user invokes the skill and the shell evaluates the output redirection.
4. The shell follows the symbolic link and truncates or replaces the target with the API response.
5. Alternatively, the attacker monitors or races access to the predictable file to obt ...[truncated 1019 chars]

Remediation

View remediation

Remediation Suggestions

Prefer processing or displaying the response directly without storing it in a temporary file:

bash

jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" \
  '{token: $token, query: $query}' |
  curl --fail-with-body --silent --show-error \
    -X POST 'https://wendao-skill-prod.ctrip.com/skill/query' \
    -H 'Content-Type: application/json' \
    --data-binary @-

If temporary storage is required:

1. Apply umask 077 before creating the file.
2. Create a unique file with mktemp rather than using a fixed name.
3. Check that temporary-file creation succeeds.
4. Quote the generated path in every command.
5. Install a trap that deletes the file on normal exit and interruption.
6. Do not reuse temporary files across requests.
7. Avoid logging the token or sensitive response content.

Example:

bash

umask 077
result_file="$(mktemp "${TMPDIR:-/tmp}/wendao-result.XXXXXX")" || exit 1
trap 'rm -f -- "$result_file"' EXIT HUP INT TERM

jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" \
  '{token: $token, query: $query}' |
  curl --fail-with-body --silent --show-error \
    -X POST 'https://wendao-skill-prod.ctrip.com/skill/query' \
    -H 'Content-Type: application/json' \
    --data-binary @- > "$result_file" || exit 1

cat -- "$result_file"

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The file presents the skill's purpose, setup, usage, and warnings exclusively in Chinese, which effectively forces a specific language for users and integrators. The policy allows fixed language only when there is explicit user opt-in or a clearly justified region-specific constraint, neither of which is stated here.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The skill sends user-supplied queries and an authentication token to an external third-party endpoint via curl. This is expected for an API-backed travel skill, but it still creates real data-exposure risk because user travel intents and secrets are transmitted off-platform, and the returned Markdown is then displayed verbatim to the user.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

通用查询

bash

jq -n --arg token "$TOKEN" --arg query "$USER_QUERY" '{token: $token, query: $query}' | curl -s -X POST https://wendao-skill-prod.ctrip.com/skill/query -H "Content-Type: application/json" -d @- > /tmp/wendao-result.md
cat /tmp/wendao-result.md

Static analysis

No suspicious patterns detected.