ClawHub
Back to skill

Security audit

Hotel Search & Compare — Fliggy MCP

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent hotel-search skill, but it asks users to install a mutable global third-party CLI and directly renders provider images and booking links without validation.

Review before installing. This skill is not evidence of malware, but it relies on a globally installed third-party npm CLI and may store an API key in that CLI's configuration. Prefer a pinned or local install if available, avoid installing with elevated privileges, and verify booking links and provider domains before entering travel, account, or payment information.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:81
Finding

Unpinned Global Installation of a Third-Party CLI

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, line 81
Vulnerability Type: Unpinned third-party dependency installed globally
Risk Level: Medium

Vulnerable Code

markdown
1. **Install CLI:** `npm i -g @fly-ai/flyai-cli`

Technical Analysis

The skill instructs users to globally install @fly-ai/flyai-cli without specifying an exact package version or verifying package integrity. Consequently, the code installed when the instruction is followed can change independently of the reviewed skill.

npm installation may also execute package lifecycle scripts. Because the package is installed globally, those scripts and the resulting executable run with the permissions of the user performing the installation. The project does not provide a lockfile, checksum, package signature, or other mechanism for verifying that the installed release is the version that was audited.

This creates a supply-chain exposure if the package, one of its dependencies, its publisher account, or a future release is compromised.

Attack Path

  1. An attacker compromises the npm package publisher, a transitive dependency, or a future package release.
  2. The attacker publishes a malicious version under the legitimate package name.
  3. A user follows the documented npm i -g @fly-ai/flyai-cli instruction.
  4. npm resolves the mutable latest version and downloads the compromised package.
  5. Malicious lifecycle code may execute during installation, or malicious behavior may run when the flyai command is subsequently invoked.
  6. The payload operates with the permissions of the installing or invoking user.

Impact Assessment

Successful exploitation could permit arbitrary code execution under the affected user's account. Depending on that account's permissions and environment, the attacker could access user-readable files, environment variables, CLI credentials, and API keys; modify user-owned files; make network requests ...[truncated 302 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the CLI to a reviewed exact version, for example:
    bash
    npm install --global @fly-ai/flyai-cli@1.2.3
  2. Prefer a project-local installation with a committed lockfile instead of modifying the user's global tool environment.
  3. Verify the package source, publisher identity, and integrity metadata before installation.
  4. Use npm provenance or signature verification where supported.
  5. Disable lifecycle scripts with --ignore-scripts if the package does not require them.
  6. Document the exact tested CLI version and establish a controlled review process before updating it.
  7. Run the CLI with least privilege and never install it through an elevated administrator or root account unless strictly necessary.

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:119
Finding

Unvalidated External URLs Rendered as Images and Booking Links

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 119-121
Vulnerability Type: Unsafe rendering of externally supplied URLs
Risk Level: Medium

Vulnerable Code

markdown
- **Image:** for each highlighted option, emit a standalone line `![]({mainPic})` using `mainPic` from the item (see `references/search-hotel.md` output example).
- **Booking / detail link:** emit a standalone line `[Click to book]({detailUrl})` using `detailUrl` from the item.
- **Order:** when both exist, show **image before** the booking link.

The corresponding response fields are documented in references/search-hotel.md, lines 46-47:

json
"mainPic": "https://img.alicdn.com/...",
"detailUrl": "...",

Technical Analysis

The instructions require the agent to interpolate mainPic and detailUrl values from an external service response directly into Markdown. No validation is required for the URL scheme, destination hostname, syntax, or embedded Markdown metacharacters.

If the upstream response is compromised or malformed, mainPic could reference an attacker-controlled tracking resource that a Markdown client automatically requests. Similarly, detailUrl could direct users to a phishing site or another untrusted destination while being displayed under the generic label Click to book.

Depending on the Markdown renderer, specially crafted values may also break out of the intended link syntax or use URI schemes that should not be presented as ordinary web links.

Attack Path

  1. An attacker compromises or manipulates the upstream hotel result, API response, or data source used by the CLI.
  2. The response contains an attacker-controlled value in mainPic or detailUrl.
  3. The agent follows the skill instructions and inserts the value directly into Markdown.
  4. For mainPic, the user's renderer may automatically contact the attacker-controlled server when displaying the answer.
  5. For `detailU ...[truncated 805 chars]
Remediation
View remediation

Remediation Suggestions

  1. Parse both fields as URLs and accept only valid https URLs.
  2. Reject non-web schemes such as javascript:, data:, file:, and custom application schemes.
  3. Maintain an allowlist of documented image and booking-provider hostnames.
  4. Normalize hostnames and reject deceptive subdomains, embedded credentials, malformed ports, and ambiguous encoded URLs.
  5. Escape Markdown-significant characters before interpolation.
  6. Display the validated destination hostname next to each booking link rather than relying solely on the generic Click to book label.
  7. Avoid automatically embedding remote images, or require user consent before the client fetches them.
  8. If validation fails, omit the image or link and clearly state that the upstream URL was rejected as unsafe.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md
Flags: `references/search-hotel.md` · setup & errors: this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 69)May include surrounding context.

md
Flags: `references/search-hotel.md` · setup & errors: this `SKILL.md`.

Ae1

High
Category
analysis-evasion
Confidence
100% confidence
Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 73)May include surrounding context.

md
Flags: `references/search-hotel.md` · setup & errors: this `SKILL.md`.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill declares very broad trigger regexes and descriptions that can match ordinary travel-related requests such as searching, comparing, or booking hotels. In an agent ecosystem, overbroad activation can cause this skill to be selected when a narrower or safer tool was intended, increasing the chance of misrouting user requests, unnecessary tool execution, and exposure of user travel details to an external service.

Content

No source excerpt is available for this finding.

Unbounded Resource Access

Medium
Category
Excessive Agency
Confidence
75% confidence
Finding

Skill allows unbounded resource consumption (API calls, storage, compute). Without rate limits or quotas, a compromised or misbehaving agent can cause denial-of-service or cost overruns.

Content

Scanner excerpt · SKILL.md (reported line 144)May include surrounding context.

md
1. **Validate** — Before running: inputs must be reasonable. Dates must not be in the past and must match the format required in `references/search-hotel.md`. If city or district names are ambiguous, **ask the user**; do **not** invent `--dest-name` or other required values.
2. **Diagnose** — On failure or odd output: read **stderr** and any `status` / `message` fields in the JSON. Distinguish parameter mistakes (fix flags using the reference doc) from network or upstream service errors.
3. **Retry** — Retry only for **transient** network or service errors; cap retries (e.g. once or twice). Do not loop indefinitely.
4. **Empty or weak results** — If the command succeeds but `itemList` is empty or too narrow: relax filters **once** (wider dates, fewer constraints), then stop and explain. Do not silently retry many times.
5. **Transparency** — If results may not match the user’s intended city, dates, or budget, **say so** and suggest confirming on the provider’s page before booking.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The file mixes English with Chinese-only parameter values and examples such as 酒店, 民宿, 客栈, destination examples like 杭州, and states prices in CNY, but it does not explain that the skill is intentionally limited to a Chinese travel context or offer a locale choice. This can create a language/locale policy issue because the skill implicitly assumes Chinese-language inputs and China-specific usage without user opt-in.

Content

No source excerpt is available for this finding.