Security audit

机票/酒店/旅行降价监控助手

Security checks for vulnerabilities and agentic risk

Overview

The skill’s price monitoring purpose is coherent, but it asks agents to create persistent monitoring jobs and optionally make travel purchases without enough cleanup, validation, or user-control safeguards.

Review this skill carefully before installing. It should require explicit confirmation before creating monitoring jobs or enabling auto-booking, validate all travel/search inputs, avoid shell-interpolated commands, and automatically remove scheduled jobs when monitoring ends.

A.I.G

Vulnerability Patterns

System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T06 · System Persistence

Error

Location: SKILL.md:50
Finding: Recurring Monitoring Task Persists Beyond Its Authorized Lifetime
Content: View full analysis
target_price: - Continue monitoring (do not notify in immediate mode) 5. If deadline is reached without meeting the target: - Send an expiration reminder and recommended options ``` ### Technical Analysis The Skill directs the Agent to create a recurring `qoder_cron` job with no end date. Although the payload contains a deadline and the execution logic sends an expiration reminder, neither section instructs the Agent to disable or delete the scheduled job. The same lifecycle defect applies when the target price is reached: the Skill directs the Agent to notify or attempt a booking, but it does not remove the recurring task. Consequently, the cron job can survive the logical completion of the request and continue initiating Agent turns every four hours. This is a cross-session persistence issue because the scheduled task survives th ...[truncated 1431 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:29
Finding: Shell Command Injection Through Unescaped User-Controlled Search Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill describes automatic booking as a feature but does not prominently warn about the financial, timing, inventory, fare-rule, refund, or duplicate-booking risks of authorizing autonomous purchases. In this context, the omission is especially dangerous because the skill performs repeated checks and may transition from monitoring to a real transaction, increasing the chance of users granting consent without understanding consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill recommends automatically canceling and rebooking travel products without warning that cancellations may incur penalties, refunds may be delayed or partial, fare rules may differ, and repricing or inventory changes can leave the user worse off. This is particularly risky in travel commerce because reservation terms are complex and time-sensitive, so automated rebooking can directly cause monetary loss or loss of confirmed travel arrangements.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill advertises broad trigger phrases such as general price monitoring and travel-shopping language, which can cause it to activate for routine browsing or advisory requests that do not imply consent for persistent tracking or booking-related actions. In this skill’s context, overbroad routing is more dangerous because the workflow includes scheduled polling and optional automatic booking, so accidental invocation can lead to unwanted monitoring or transactional side effects.
Content: No source excerpt is available for this finding.