Check Bookings Phone

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:01 AM UTC
• Version: 1.0.2

Overview

The skill appears intended to check Ctrip booking availability, but it needs review because it can automatically approve phone permission and terms dialogs while controlling a logged-in Android app.

Install only if you are comfortable letting the skill control a logged-in Android phone over ADB and send Ctrip screenshots containing order details to your configured model provider. Supervise runs closely and avoid allowing it to accept permission requests or user agreements on your behalf; prefer npm ci with reviewed dependencies and update the flagged transitive packages before routine use.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/checkBookings.ts:96

Finding

Indiscriminate Approval of Application Permissions and User Agreements

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: SKILL.md:18

Finding

Dependency Installation Executes Third-Party Lifecycle Scripts

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (39)

Known Vulnerable Dependency: form-data==4.0.2 — 2 advisory(ies): CVE-2025-7783 (form-data uses unsafe random function in form-data for choosing boundary); CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

Critical

• Category: Supply Chain
• Confidence: 95% confidence

Finding

form-data 4.0.2 is flagged for unsafe boundary generation and CRLF injection issues in multipart field names/filenames. If this dependency is used to send multipart requests with attacker-influenced fields, it can enable request smuggling-like behavior, malformed requests, or downstream parser abuse.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

md

cd $SKILL_DIR && npx tsx scripts/checkBookings.ts --from 2026-05-01 --to 2026-05-05

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 96)May include surrounding context.

md

cd $SKILL_DIR && npx tsx scripts/checkBookings.ts --from 2026-05-01 --to 2026-05-05

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

md

cd $SKILL_DIR && npx tsx scripts/checkBookings.ts --from 2026-05-01 --to 2026-05-05

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 102)May include surrounding context.

md

cd $SKILL_DIR && npx tsx scripts/checkBookings.ts --from 2026-05-01 --to 2026-05-05

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 105)May include surrounding context.

md

cd $SKILL_DIR && npx tsx scripts/checkBookings.ts --from 2026-05-01 --to 2026-05-05

Known Vulnerable Dependency: lodash==4.17.21 — 3 advisory(ies): CVE-2025-13465 (lodash vulnerable to Prototype Pollution via array path bypass in `_.unset` and ); CVE-2021-23337 (lodash vulnerable to Code Injection via `_.template` imports key names); CVE-2025-13465 (Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions)

High

• Category: Supply Chain
• Confidence: 90% confidence

Finding

lodash 4.17.21 is widely known to have security advisories, including prototype pollution and template-related risks in certain usage patterns. In this lockfile it appears as a transitive dependency, so exploitability depends on whether vulnerable APIs such as _.template, _.unset, or _.omit are exposed to attacker-controlled input, but it is still a legitimate supply-chain risk.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: sharp==0.34.2 — 2 advisory(ies): GHSA-f88m-g3jw-g9cj (sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-); GHSA-rgj7-g3m4-5g8c (sharp: Vulnerabilities in libheif: GHSA-g89c-p67h-r497 and GHSA-2jg2-4ch7-h545)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

sharp 0.34.2 is reported with inherited vulnerabilities from native image-processing libraries. This skill performs Android automation and may handle screenshots or media frames, which makes image parsing libraries more security-relevant than in a typical backend-only package set.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @modelcontextprotocol/sdk==1.10.2 — 3 advisory(ies): CVE-2026-25536 (@modelcontextprotocol/sdk has cross-client data leak via shared server/transport); CVE-2026-0621 (Anthropic's MCP TypeScript SDK has a ReDoS vulnerability); CVE-2025-66414 (Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protec)

High

• Category: Supply Chain
• Confidence: 91% confidence

Finding

@modelcontextprotocol/sdk 1.10.2 carries advisories including cross-client data leak, ReDoS, and DNS rebinding protection issues. Because this skill stack includes automation plus AI/agent-related libraries, any MCP exposure could increase the risk of data leakage or abuse if a server or transport is enabled in the runtime environment.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: @xmldom/xmldom==0.8.11 — 15 advisory(ies): CVE-2026-83608 (xmldom: DocType `name` Injection Bypasses requireWellFormed); CVE-2026-41673 (xmldom: Uncontrolled recursion in XML serialization leads to DoS); CVE-2026-83605 (xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed) +12 more

High

• Category: Supply Chain
• Confidence: 93% confidence

Finding

@xmldom/xmldom 0.8.11 has numerous advisories including malformed XML handling and serialization issues. While the lockfile does not prove active XML parsing of attacker input, a dependency with this advisory density is a meaningful supply-chain concern, especially in automation stacks that may parse device metadata or plist/XML content.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.9.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

axios 1.9.0 is flagged for multiple serious advisories including SSRF- and prototype-pollution-related issues. Since this skill depends on libraries that may perform network calls for automation, AI, or remote services, vulnerable HTTP client behavior can materially increase exposure if any endpoint or proxy settings are attacker influenced.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==2.0.2 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-33750 (brace-expansion: Zero-step sequence causes process hang and memory exhaustion); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

• Category: Supply Chain
• Confidence: 84% confidence

Finding

brace-expansion 2.0.2 is reported vulnerable to DoS via pathological expansion input. This is usually only exploitable when attacker-controlled glob or brace patterns are processed, so the dependency is vulnerable even if real-world exploitability in this skill may be limited.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: glob==10.4.5 — 1 advisory(ies): CVE-2025-64756 (glob CLI: Command injection via -c/--cmd executes matches with shell:true)

High

• Category: Supply Chain
• Confidence: 81% confidence

Finding

glob 10.4.5 is reported vulnerable to command injection via CLI flags that execute matches with shell:true. This matters mainly if the glob CLI is invoked with untrusted arguments; although the lockfile alone does not prove that usage, the vulnerable dependency is real.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: ip-address==10.1.0 — 2 advisory(ies): CVE-2026-69192 (ip-address: Address4 decodes leading-zero octets as decimal while resolvers deco); CVE-2026-42338 (ip-address has XSS in Address6 HTML-emitting methods)

High

• Category: Supply Chain
• Confidence: 80% confidence

Finding

ip-address 10.1.0 is reported with parsing ambiguity and HTML/XSS issues. In this skill, the most plausible concern would be SSRF or allowlist bypass if IP parsing is used for network trust decisions, but the lockfile alone does not show such use.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the automation agent to click through permission dialogs, user agreements, and consent prompts without any user confirmation. This can grant the app sensitive device permissions or accept legal/privacy terms on the user's behalf, which is especially risky because the skill operates on a real Android device and may encounter prompts with significant privacy or security consequences.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The documentation instructs users to run npx tsx, which can resolve and execute a package from the registry if it is not already installed locally or if resolution behavior changes. That creates a supply-chain risk because an unpinned tool version may introduce unexpected code execution during skill setup or use.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 90% confidence

Finding

The install instruction uses npx skills without pinning a version, so execution may pull and run the latest package code from the registry. In a security-sensitive workflow, this increases exposure to package compromise, typo-squatting, or breaking behavior changes.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This example again relies on npx tsx without a pinned version, preserving the same risk of fetching and executing untrusted or changed registry code. Repetition in usage examples makes unsafe invocation more likely because users commonly copy-paste these commands directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

Using unpinned npx tsx in another documented command continues the supply-chain execution risk. Because this skill automates a logged-in mobile app and processes potentially sensitive booking data, running unexpected code in the operator environment is more concerning than in a trivial demo skill.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

The cross-month query example still uses npx tsx without version pinning, leaving users exposed to registry-side package changes or compromise. Since these commands are intended for end users, documentation-level unsafe defaults are a real operational weakness rather than a purely theoretical issue.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 91% confidence

Finding

This final example repeats the same unpinned npx tsx pattern, so the user may execute a non-reproducible external package version. The skill's context increases risk somewhat because it operates with ADB access and handles screenshots that may contain private travel and pricing information, so compromise of the execution environment could expose sensitive data or device control.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package-lock.json (reported line 66)May include surrounding context.

json

"axios": "1.9.0",
        "base64-stream": "1.0.0",
        "bluebird": "3.7.2",
        "bplist-creator": "0.1.1",
        "bplist-parser": "0.3.2",
        "form-data": "4.0.2",
        "get-stream": "6.0.1",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package-lock.json (reported line 67)May include surrounding context.

json

"axios": "1.9.0",
        "base64-stream": "1.0.0",
        "bluebird": "3.7.2",
        "bplist-creator": "0.1.1",
        "bplist-parser": "0.3.2",
        "form-data": "4.0.2",
        "get-stream": "6.0.1",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package-lock.json (reported line 80)May include surrounding context.

json

"axios": "1.9.0",
        "base64-stream": "1.0.0",
        "bluebird": "3.7.2",
        "bplist-creator": "0.1.1",
        "bplist-parser": "0.3.2",
        "form-data": "4.0.2",
        "get-stream": "6.0.1",

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · package-lock.json (reported line 2530)May include surrounding context.

json

"axios": "1.9.0",
        "base64-stream": "1.0.0",
        "bluebird": "3.7.2",
        "bplist-creator": "0.1.1",
        "bplist-parser": "0.3.2",
        "form-data": "4.0.2",
        "get-stream": "6.0.1",

Static analysis

No suspicious patterns detected.