T09 · Insecure Skill Coding Practices
Error
- Location
scripts/plan-roadbook.mjs:12- Finding
Default Public Exfiltration of Travel Data and Amap Credentials over Plaintext HTTP
- Content
View full analysis
- Remediation
View remediation
Security audit
高德 AI 路书
Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is useful and mostly coherent, but its default public publishing can expose private itinerary details and Amap credentials through unsafe upload and rendering paths.
Use Review before installing. Prefer local-only generation unless you are comfortable publishing the itinerary, dates, lodging areas, budget, and generated files publicly. Do not use valuable or unrestricted Amap keys with this skill as written; restrict and rotate keys if tested. The publisher should make publishing explicit opt-in, remove credentials from exported JSON, use authenticated HTTPS publishing, enforce the token server-side, avoid shell string execution, and sanitize generated HTML.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/publish-server.mjs:55- Finding
Unauthenticated Public Publishing Service Permits Arbitrary Content Replacement
- Content
View full analysis
{}); await fs.chmod(PUBLISH_ROOT, 0o755).catch(() => {}); for (const name of allowed) { if (!(name in files)) continue; const entry = files[name] || {}; if (!safeFilename(name)) { return sendJson(res, 400, { error: `Invalid filename: ${name}` }); } const encoding = entry.encoding === "base64" ? "base64" : "utf8"; const content = entry.content ?? ""; const filePath = path.join(targetDir, name); await writeDecodedFile(filePath, content, encoding); } const result = { publishId, htmlUrl: `${PUBLIC_BASE_URL}/${publishId}/`, xlsxUrl: `${PUBLIC_BASE_URL}/${publishId}/roadbook.xlsx`, jsonUrl: `${PUBLIC_BASE_URL}/${publishId}/roadbook.json`, remoteDir: targetDir }; return sendJson(res, 200, re ...[truncated 2653 chars]- Remediation
View remediation
` and fail if the token is absent. 4. Bind to `127.0.0.1` by default and expose the service only through an authenticated TLS reverse proxy. 5. Separate creation and update operations. Require publication-specific authorization to replace an existing ID. 6. Generate IDs exclusively on the server and use high-entropy values. Do not silently accept unauthorized caller-selected IDs. 7. Write replacements atomically and preserve recoverable versions rather than deleting the existing directory first. 8. Add rate limiting, per-principal quotas, audit logging, storage limits, and abuse monitoring. 9. Apply a restrictive Content Security Policy and isolate user publications on a separate origin. 10. Reject requests that omit mandatory files or contain malformed content, and validate file signatures and sizes individually. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/plan-roadbook.mjs:600- Finding
Shell Command Injection through the Excel Output Path
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
assets/roadbook.html:651- Finding
Stored DOM Cross-Site Scripting in Generated Roadbook Pages
- Content
View full analysis
0; var poiThumbHtml = ''; var poiInfoHtml = ''; if (hasPoi) { var starsHtml = stop.poiRating ? ' ' + '★'.repeat(Math.round(parseFloat(stop.poiRating))) + ' ' + stop.poiRating + '' : ''; var tagHtml = stop.poiTag ? ' ' + stop.poiTag + '' : ''; var thumbsHtml = ''; for (var pi = 0; pi < stop.poiPhotos.length && pi < 5; pi++) { thumbsHtml += ''; poiThumbHtml = thumbsHtml; poiInfoHtml = ''; } thumbsHtml += '
' + '' + normalize(stop.time, '') + '' + '' + stop.name + '' + '' + '' + starsHtml + tagHtml + ''; } var bodyHtml = ''; if (hasPoi) { bodyHtml += ''; stopEl.innerHTML = gutterHtml + bodyHtml; ``` Additional unsafe sinks include: ```javascript legEl.innerHTML = '' + poiInfoHtml + '' + poiThumbHtml + '' + normalize(stop.note, '') + ''; } else { var headerHtml = '' + ''; bodyHtml += headerHtml + '' + '' + normalize(stop.time, '') + '' + '' + stop.name + '' + '' + '' + normalize(stop.note, '') + ''; } bodyHtml += '- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (35)
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 脚本 `scripts/plan-roadbook.mjs` 中的 `resolveKey()` 按以下优先级读取 Key：
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如果脚本生成了 `roadbook.html`、`index.html` 或 `roadbook.xlsx`，回答里必须明确列出对应地址或文件路径；如果某个产物生成失败，必须直接说明失败原因或缺失项。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md 如果脚本生成了 `roadbook.html`、`index.html` 或 `roadbook.xlsx`，回答里必须明确列出对应地址或文件路径；如果某个产物生成失败，必须直接说明失败原因或缺失项。
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md node scripts/export-excel.mjs --input output/roadbook.json --output output/roadbook.xlsx
Known Vulnerable Dependency: brace-expansion==1.1.15 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)
High
- Category
- Supply Chain
- Confidence
- 93% confidence
- Finding
The lockfile pins brace-expansion 1.1.15, which the finding identifies as affected by multiple denial-of-service issues involving pathological brace patterns that can trigger excessive CPU or memory consumption. Even though this is only a transitive dependency in a build/runtime package graph, it is still a real supply-chain risk if any code path processes attacker-influenced glob or pattern input.
- Content
Known Vulnerable Dependency: brace-expansion==2.1.1 — 3 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro); CVE-2026-69152 (brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-1)
High
- Category
- Supply Chain
- Confidence
- 90% confidence
- Finding
The lockfile also contains brace-expansion 2.1.1, flagged for the same DoS-class weaknesses, so this is a separate true vulnerable instance from another transitive dependency path. If attacker-controlled brace expressions reach that library, the process may suffer resource exhaustion and become unavailable.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The script copies AMAP_JS_API_KEY and AMAP_JS_SECURITY_CODE into the generated roadbook object, writes them into JSON/HTML artifacts, and can then publish those artifacts to a public endpoint. This exposes live credentials to anyone who can access the generated files, enabling unauthorized API use, quota theft, and possible account abuse.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The generated roadbook includes sensitive API material directly in output files, but the script provides no warning that these files contain credentials and may be shared or published. In this skill's context, public publishing is a default workflow, which makes accidental secret disclosure especially likely and severe.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill requires environment variables, network access, and shell execution, but it does not declare an explicit tool scope such as allowed-tools or permissions. This weakens defense-in-depth because the runtime may grant broader capabilities than reviewers or users expect, making misuse of shell/network actions harder to constrain or audit.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill states that travel artifacts are published to a publicly accessible directory by default unless the user explicitly opts out. Because those artifacts may include travel dates, lodging areas, companions, and budget details, default public release creates a privacy exposure without affirmative user consent at the point of action.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation says the publish server may run with no token by default, meaning uploads can be accepted without authentication if operators keep the insecure default. An unauthenticated publishing endpoint can allow arbitrary file publication, defacement, storage abuse, or hosting of attacker-controlled content on the public server.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to proactively return public URLs plus server and file paths for generated artifacts containing itinerary data. This increases exposure by making sensitive travel information easy to access and by disclosing internal filesystem locations that are unnecessary for most users and useful for reconnaissance.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The display name, description, and default prompt are all written to produce a Chinese-language travel roadbook, but there is no indication that users may select another language or opt into this locale-specific behavior. This can violate language or locale policy when a skill imposes a specific language by default without explicit user choice.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill enables implicit invocation without any trigger scoping or user-confirmation constraints, which can cause the agent to invoke this travel-planning skill in contexts the user did not clearly request. In this skill’s broader context, that is more concerning because it can generate and publish publicly accessible route-book artifacts and may encourage use of configured API keys, increasing the chance of unintended data exposure or external actions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document declares
lang="zh-CN"and the visible title text is exclusively Chinese, indicating the skill experience is fixed to Simplified Chinese. Under the policy rule, forcing a specific language/locale without user opt-in or a documented regional justification is a natural-language policy violation.- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
This markdown file presents all instructions and operational guidance exclusively in Chinese, and there is no indication that the skill is region-specific or that users can opt into another language. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The entire skill scenario file is written exclusively in Chinese and does not indicate that language selection is optional or user-configurable. Under the policy, forcing a specific language or locale without opt-in is a natural-language policy violation unless the regional constraint is explicitly documented and justified.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The example request schema fixes
languagetozh-CN, which is a natural-language locale constraint. Because the document does not state that the skill is region-specific or allow alternate user-selected locales, it appears to force a specific language without opt-in.- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest describes generating Amap roadbook artifacts with itinerary, routing, weather reminders, and assumptions, but this exporter also synthesizes a dedicated budget sheet with hard-coded fare, lodging, meal, and total-budget estimates. That is not merely formatting existing roadbook data into Excel; it introduces new derived travel-finance content that is not mentioned in the file's own stated purpose of exporting roadbook.json to formatted Excel.
- Content
Static analysis
Detected: suspicious.dangerous_exec, suspicious.env_credential_access
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- scripts/plan-roadbook.mjs:663
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- scripts/plan-roadbook.mjs:41