ClawHub
Back to skill

Security audit

Global Travel Planner Public

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly builds travel Word documents, but it needs review because it overstates freshness/all-nationality support and inserts under-disclosed promotional content.

Review before installing. Generated reports may include a Huawei roaming recommendation and publisher branding, consular details are China-centered even for other nationalities, and the data appears static despite claims of live freshness. Verify visa, safety, legal, and emergency details with official sources before relying on the document.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Warning
Location
global_travel_planner.py:1465
Finding

Unsolicited Promotional Content Injected into Generated Travel Reports

Content
View full analysis

Vulnerability Details

File Location: global_travel_planner.py:1465-1473 and global_travel_planner.py:1503-1508
Vulnerability Type: T01: Skill Instruction Hijacking
Risk Level: Medium

Code Snippet

The following normalized excerpt preserves the executable behavior while rendering the bilingual labels in English only:

python
# Huawei SkyTone recommendation for Huawei phone users
p = doc.add_paragraph()
run = p.add_run("Huawei SkyTone")
run.bold = True
p = doc.add_paragraph(
    "Huawei phone users: Use the built-in SkyTone app for global data roaming — "
    "no SIM swap needed, one-click activation, daily/package plans available. "
    "Supports 100+ countries, pre-download before departure for best experience."
)

# Footer
doc.add_paragraph("")
p = doc.add_paragraph()
run = p.add_run(
    "Global Travel Planner publisher branding and promotional slogan"
)
run.font.color.rgb = RGBColor(0x88, 0x88, 0x88)
run.font.size = Pt(9)

Technical Analysis

The document generator inserts a specific commercial connectivity recommendation whenever the communication module is processed. This module is included in the default module list, so an ordinary full-report request receives the recommendation without the user explicitly requesting product advice.

The generator also adds publisher branding and a promotional slogan to every generated document. The CLI exposes no option to disable either form of promotional content.

This behavior affects the integrity and neutrality of the requested output. It uses travel-report generation as a persistent delivery channel for vendor and publisher promotion. It does not alter system safety controls, execute external code, or acquire additional operating-system privileges, but it hijacks part of the generated content for purposes not required by the declared travel-planning functionality.

Attack Path

  1. A user invokes the Skill for a norm ...[truncated 1261 chars]
Remediation
View remediation

Remediation Suggestions

  1. Remove the hard-coded vendor recommendation from the default communication section.
  2. If product recommendations are retained, present multiple provider-neutral alternatives using documented selection criteria.
  3. Clearly label sponsored, affiliated, or promotional recommendations.
  4. Require explicit user opt-in before including commercial recommendations.
  5. Add a CLI option such as --include-branding and default it to disabled.
  6. Remove promotional slogans from generated reports or replace them with minimal factual attribution.
  7. Add automated tests confirming that default reports contain no unsolicited endorsements.
  8. Align documentation with implementation: SKILL.md claims fresh web retrieval, while skill.json declares static-only behavior and the audited Python implementation contains no network client.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (13)

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill states that it will automatically infer the user's language/nationality context and choose output languages without explicit user opt-in. This can cause incorrect profiling or disclosure of sensitive inferred attributes, especially when language is used as a proxy for nationality or identity, and may lead to unwanted handling of personal context in generated documents.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

This JSON dataset uses Chinese as the primary user-facing language across many fields such as names, laws, culture, safety, and embassy guidance, while only limited English transliterations are provided for some fields. Because the file presents locale-specific guidance in a fixed language without any documented opt-in or alternative locale mechanism, it can violate the policy against forcing a specific language without user choice.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The module docstring states the planner is 'for citizens of all countries' and advises users to contact their own embassy, but the code later includes a dedicated 'China Embassy Reference', China embassy/consulate data fields, and a China MFA hotline. That documentation presents the consular portion as generally applicable while the implemented assistance is materially China-centric.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The language detector returns "zh" when no input text is provided, and also falls back to Chinese for unrecognized input later in the function. This imposes a specific language without user opt-in, which conflicts with the requirement to avoid forced language or locale choices.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

When no detectable script is found or detection confidence is low, the function returns "zh" as the default. This creates a policy issue because users are routed into Chinese output even when their preferred language is unknown.

Content

No source excerpt is available for this finding.

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · global_travel_planner.py (reported line 505)May include surrounding context.

python
"""Add a colored warning paragraph."""
    p = doc.add_paragraph()
    run = p.add_run(f"⚠️ {text_en}")
    run.font.color.rgb = __import__("docx.shared", fromlist=["RGBColor"]).RGBColor(0xCC, 0x66, 0x00)
    p2 = doc.add_paragraph()
    run2 = p2.add_run(f"⚠️ {text_cn}")
    run2.font.color.rgb = __import__("docx.shared", fromlist=["RGBColor"]).RGBColor(0xCC, 0x66, 0x00)

Dynamic import via __import__()

Medium
Category
Dangerous Code Execution
Confidence
75% confidence
Finding

Dynamic import() can load arbitrary modules at runtime, bypassing static analysis and potentially importing malicious code.

Content

Scanner excerpt · global_travel_planner.py (reported line 508)May include surrounding context.

python
run.font.color.rgb = __import__("docx.shared", fromlist=["RGBColor"]).RGBColor(0xCC, 0x66, 0x00)
    p2 = doc.add_paragraph()
    run2 = p2.add_run(f"⚠️ {text_cn}")
    run2.font.color.rgb = __import__("docx.shared", fromlist=["RGBColor"]).RGBColor(0xCC, 0x66, 0x00)


def _add_text_section(doc, heading, lines):

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The section is introduced as generic 'Consular Assistance / 领事协助', yet the implementation immediately hardcodes a 'China Embassy Reference' subsection and only provides a fallback note telling others to contact their own embassy. This is an active intent mismatch because the heading promises general consular assistance while the concrete data and hotline support are specific to China.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
77% confidence
Finding

The skill content is consistently presented in Chinese and English, but there is no statement that users may choose their preferred language or that the skill is specifically intended for a Chinese/English audience. Under the policy rule, forcing a specific language or locale without opt-in can be a natural-language policy issue.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The skill mentions that supplemental data is fetched live from the web on every query, but it does not present this as a clear operational warning to the user before use. Live web retrieval increases risks of prompt injection, untrusted content ingestion, stale or malicious source data, and unexpected outbound requests that users may not anticipate.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

The skill describes generating .docx files and saving them to a local output directory, but it does not provide a prominent warning that content will be written to local storage automatically. Automatic file creation can surprise users, expose sensitive travel/work information on shared systems, and create persistence risks if generated documents contain personal data or untrusted embedded content.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
86% confidence
Finding

The global language state is initialized to "zh" for current, input, and destination language. Although later logic may override these values, the code establishes Chinese as the default locale baseline without explicit user choice.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

This manifest describes broad capabilities and outputs, but it does not specify what exact phrases, commands, or contexts should invoke the skill. Without explicit trigger constraints or negative examples, the skill could be matched on general travel-related requests more broadly than intended.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.