Security audit

Quxizang Skill

Security checks for vulnerabilities and agentic risk

Overview

This Tibet travel skill is mostly coherent, but it needs Review because it under-discloses external API use and includes detailed medical and safety guidance that users could rely on in dangerous situations.

Before installing, treat this as a Review item: use it for cultural and travel planning ideas, but do not rely on it for medical decisions, road-opening decisions, or emergency care. Replace or remove the bundled Gaode API key, make external search/API behavior explicit, and verify weather, closures, permits, hospitals, and health advice with official or licensed sources before acting.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (13)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 86% confidence
Finding: The skill declares no permissions, yet its documented components imply environment access, file I/O, and network use. This creates a trust and review gap: hosts or users may approve the skill believing it is passive content, while it can actually call APIs, read configuration, and persist local state.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 89% confidence
Finding: The stated purpose is a travel-guide persona, but the described implementation includes external API calls, local usage tracking, auditing utilities, and programmatic rule engines that materially expand behavior beyond the declared scope. This mismatch can hide operational risk, cause reviewers to underestimate data handling and network exposure, and enable unintended execution paths in environments that trust the description.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The README makes conflicting security-relevant deployment claims: it says the skill has 'zero API dependency' and 'no API keys required' while also documenting a built-in Gaode API test key and API-backed functionality. This can mislead deployers into assuming the skill has no external service dependency, no outbound data flow, and no embedded credential risk, reducing scrutiny during installation and potentially exposing users to third-party data handling or quota abuse.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The file explicitly claims there is no runtime engine or external service usage, but elsewhere mandates live WebSearch and references API-backed data sources. Contradictory security-relevant statements are dangerous because they can mislead reviewers and users about whether data leaves the environment or whether real-time external dependencies are invoked.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: This file goes far beyond general travel safety tips and provides detailed medical screening, disease contraindications, monitoring thresholds, and action protocols. In a travel-guide skill framed by a non-physician persona, users may treat this as personalized medical triage and delay proper clinical assessment, creating a meaningful risk of physical harm.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The document gives quasi-clinical instructions such as blood pressure and oxygen cutoffs, medication carriage and use guidance, steroid references, benzodiazepine dosing, and condition-specific self-management steps. Because the skill is a travel advisor rather than a regulated medical system, this can prompt unsafe self-treatment, misuse of prescription drugs, and failure to seek urgent care when needed, especially in high-altitude environments where deterioration can be rapid.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The prompt embeds author contact details and instructs the agent to append promotional follow-up messaging at the end of a user's trip, which is unrelated to the core travel-assistance function. This creates an unnecessary data-flow and persuasion channel inside a system prompt, increasing the risk of covert advertising, user manipulation, and policy non-compliance if the agent surfaces personal promotion without explicit user request.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The document explicitly claims 'zero external API dependencies' while also instructing use of Open-Meteo and a local script that queries Gaode POI data. This contradiction can mislead reviewers, operators, or downstream agents about network behavior, privacy exposure, and reliability assumptions, causing undeclared third-party data flows to be used in production.

Context-Inappropriate Capability

Medium

Confidence: 99% confidence
Finding: The script hard-codes a Gaode API key in source and also uses it as the default runtime credential. Embedded shared secrets are dangerous because anyone with code access can extract and abuse the key, consume quota, or tie activity back to the operator. In a travel-guide skill, this is unnecessary exposure of a credential and broadens the attack surface beyond the stated knowledge-base purpose.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: This file provides detailed month-by-month recommendations for hazardous, high-altitude road travel in Tibet, including statements like routes being '可走' or '最佳', but it lacks a prominent disclaimer that mountain weather, landslides, snow, closures, police controls, and medical/emergency conditions can change rapidly. Users may treat the guidance as authoritative and current, leading them to attempt dangerous travel without verifying official road, weather, rescue, fuel, or permit conditions, which can result in stranding, accidents, or exposure in remote areas.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The file gives medical-sounding health advice such as claiming foods help with altitude sickness or diarrhea and comparing them favorably to medicine, without warning users not to rely on it as medical guidance. In a travel skill, users may act on this instead of seeking proper treatment, which is risky in high-altitude settings where delayed care can become serious.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill recommends and normalizes eating raw or air-dried yak meat dishes, but the warning only mentions taste tolerance and weak stomachs, not foodborne illness or parasite risk. Because this is practical dining guidance for travelers, users may interpret it as an endorsement of safety and consume risky raw meat in conditions where sanitation and medical access may be limited.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The content gives concrete route recommendations involving rapid ascent to high altitude and explicitly discusses altitude sickness risk, but it lacks a prominent medical/safety disclaimer or clear thresholds for seeking professional care. In a travel-planning skill, users may treat this as actionable guidance and underestimate the seriousness of acute mountain sickness, HAPE, or HACE, especially when the text frames some options as suitable without advising consultation, symptom monitoring, or emergency escalation.

Static analysis

No suspicious patterns detected.