Travel Search

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 1:45 AM UTC
• Version: 1.5.0

Overview

This travel skill uses disclosed travel-provider network calls for live searches, with some privacy and dependency-installation cautions but no evidence of hidden or malicious behavior.

Install only if you are comfortable with travel searches being sent to the named third-party providers. Avoid including unnecessary sensitive details, and pin or sandbox the optional npm/pip integrations before installing them.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: references/airbnb.md:14

Finding

Unpinned Global npm Package Installation

Content

View full analysis

Remediation

View remediation

``` - Prefer a project-local installation over `npm install -g` so the dependency is isolated and represented in a lockfile. - Commit and review `package-lock.json`, and use `npm ci` for reproducible installation. - Record and verify the expected package publisher, source repository, release provenance, and integrity metadata. - Audit package lifecycle scripts and transitive dependencies before approving upgrades. - Run the MCP server under a restricted account or sandbox with only the filesystem and network access required for travel searches. - Treat every version upgrade as a new code-review event rather than allowing automatic resolution to the latest release. ]]>

T08 · Insecure Dependencies

Warning

• Location: references/google-flights.md:5

Finding

Unpinned Python Package Installation

Content

View full analysis

Remediation

View remediation

``` - Install it inside a dedicated virtual environment rather than into a shared system or user environment. - Generate a fully resolved requirements lock containing hashes and install with hash enforcement, for example: ```bash python -m pip install --require-hashes -r requirements.txt ``` - Verify the package's publisher, source repository, signed release provenance, and expected command entry points. - Review build-system configuration and installation hooks before approving the package. - Pin and audit transitive dependencies as well as the direct package. - Run the MCP process with restricted filesystem access and only the network permissions required for its intended operation. - Require a new dependency review before updating the pinned version. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: references/flights.md:7

Finding

Predictable Shared Temporary File Used for MCP Response Headers

Content

View full analysis

Remediation

View remediation

/dev/null SESSION=$( awk 'BEGIN { IGNORECASE=1 } /^mcp-session-id:/ { sub(/\r$/, "", $2) print $2 exit }' "$HEADER_FILE" ) ``` Additional hardening should include: - Prefer invoking `scripts/mcp-call.sh`, which already uses `mktemp`, instead of duplicating an unsafe setup example. - Quote every temporary path and remove it using a single-quoted cleanup trap. - Keep temporary files private with mode `0600`. - Validate the extracted session identifier against the provider's expected character set and maximum length before placing it in a request header. - Use a unique temporary file for every invocation to prevent collisions between concurrent searches. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (24)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes real-time travel searches and direct booking links but does not clearly disclose that user-supplied trip details will be transmitted to third-party travel providers. In an agent setting, users may assume the skill works locally, so this omission can cause unintended sharing of destinations, dates, budgets, and itinerary preferences with external services.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README explicitly states that agents call provider MCP servers directly via curl, but it still fails to warn users that this causes outbound network requests to external services. In a tool-executing agent environment, lack of disclosure reduces informed consent and can expose travel plans, location patterns, and other personal context to multiple third parties.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes a travel search and comparison skill focused on flights, hotels, Airbnb, car rentals, ferries, itineraries, and provider-based deal finding. The roadmap adds a broader 'Travel Intel' capability covering weather forecasts, visa information, safety notes, currency/tipping guidance, and connectivity advice, which extends beyond the described search/comparison scope.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill invokes shell-based network operations via curl but does not declare any explicit tool scope such as permissions or allowed-tools. This weakens least-privilege controls and can let the skill run with broader execution capability than users or the platform may expect, increasing the blast radius if the skill is misused or later modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The invocation description is extremely broad and overlaps with many ordinary travel-related requests, which can cause the skill to trigger in situations where users did not intend third-party search or itinerary processing. Over-broad routing increases privacy and safety risk because user travel plans, destinations, and dates may be sent externally more often than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill lacks a clear user-facing warning that itinerary details and travel preferences will be transmitted to third-party provider endpoints. Users may disclose sensitive travel data such as dates, routes, and lodging preferences without informed consent, creating privacy and profiling risks.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 91% confidence

Finding

The skill instructs the agent to POST data to an externally supplied $MCP_URL using curl, which creates an external transmission path for user-provided travel queries and potentially for secrets or environment-derived session data. Because the URL is variable rather than tightly constrained in the example, misconfiguration or abuse could direct requests to unintended hosts.

Content

Scanner excerpt · SKILL.md (reported line 32)May include surrounding context.

bash

# 1. Initialize session
curl -s -X POST "$MCP_URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/ferries.md (reported line 11)May include surrounding context.

bash

# Initialize and capture session
curl -s -X POST "https://mcp.ferryhopper.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -D /tmp/ferry-headers.txt \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/ferries.md (reported line 27)May include surrounding context.

List available ports and their details. Use to find port IDs.

bash

curl -s -X POST "https://mcp.ferryhopper.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: $SESSION" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flights.md (reported line 9)May include surrounding context.

bash

# Initialize session (required first)
INIT=$(curl -s -X POST "https://mcp.kiwi.com" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -D /tmp/kiwi-headers.txt \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · references/flights.md (reported line 42)May include surrounding context.

Example: One-way flight

bash

curl -s -X POST "https://mcp.kiwi.com" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: $SESSION" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation directs users to send travel queries, dates, and session-bearing requests to a third-party MCP endpoint without any notice that user itinerary data is being transmitted off-platform. In a travel-search skill, this is operationally relevant data and may include sensitive travel patterns; the risk is increased because the examples normalize direct external submission and session handling without privacy guidance or minimization.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

This example performs a live POST to an external service and stores returned headers locally to extract a session identifier. While not inherently malicious, it establishes unaudited outbound communication to a third party and encourages handling of session material without warning about privacy, trust boundaries, or secure storage.

Content

Scanner excerpt · references/hotels.md (reported line 9)May include surrounding context.

bash

# Initialize and capture session
curl -s -X POST "https://mcp.trivago.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -D /tmp/trivago-headers.txt \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 90% confidence

Finding

This command sends destination, dates, and occupancy details to a remote MCP endpoint using a session token, which can expose user travel plans to a third party. In the context of a travel-booking skill, such transmission is expected for functionality, but the absence of disclosure, consent cues, or data-handling guidance makes it a legitimate privacy/security weakness rather than a false positive.

Content

Scanner excerpt · references/hotels.md (reported line 25)May include surrounding context.

Search hotels by destination name.

bash

curl -s -X POST "https://mcp.trivago.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -H "Mcp-Session-Id: $SESSION" \

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The flexible-date and destination search workflow directs the agent to use external Skiplagged endpoints with origin, destination, and dates, but provides no warning that user travel data will leave the system. Because flexible-date and 'anywhere' searches can expose user location, budget, and future movement patterns, the missing notice is a genuine privacy weakness.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 81% confidence

Finding

The markdown contains concrete curl commands that POST data to an external MCP endpoint, demonstrating direct transmission of user-supplied travel search parameters to a third party. While external requests are expected for a travel-search skill, the risk is real because the instructions do not include safeguards around consent, minimization, provider trust, or handling of sensitive travel data.

Content

Scanner excerpt · references/price-tools.md (reported line 44)May include surrounding context.

bash

# Flexible departure dates
curl -s -X POST "https://mcp.skiplagged.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file instructs the agent to generate booking links and compare third-party travel providers, but it does not tell the agent to warn users that their travel queries may be sent to external services. Travel searches can reveal sensitive itinerary data such as dates, locations, and trip patterns, so omission of a privacy/data-sharing notice creates a real transparency and privacy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The document instructs the agent to send travel-search inputs to a third-party MCP endpoint but does not warn that user itinerary data, locations, dates, and accommodation preferences will be transmitted externally. This is a real privacy and transparency issue because users may disclose sensitive travel plans without informed consent, increasing exposure of personal and behavioral data to an external service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 85% confidence

Finding

This example performs a network POST to an external Skiplagged MCP server, establishing data flow to a third party. While initialization itself contains limited data, it still creates an external connection and normalizes outbound transmission behavior in a skill that handles potentially sensitive travel information.

Content

Scanner excerpt · references/skiplagged.md (reported line 11)May include surrounding context.

bash

# Initialize (once per session)
curl -s -X POST "https://mcp.skiplagged.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{"jsonrpc":"2.0","id":1,"method":"initialize","params":{"protocolVersion":"2025-06-18","capabilities":{},"clientInfo":{"name":"openclaw","version":"1.0"}}}'

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 96% confidence

Finding

This call sends user-derived location input such as city names to an external MCP endpoint, which is a concrete transmission of potentially sensitive travel-planning data. In the context of a travel skill, repeated searches can reveal intended destinations, timing, and movement patterns, making the omission of disclosure and consent more significant.

Content

Scanner excerpt · references/skiplagged.md (reported line 36)May include surrounding context.

Before searching flights, resolve city names to IATA codes:

bash

curl -s -X POST "https://mcp.skiplagged.com/mcp" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -d '{

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The phrase "Any trip planning (automatically append key intel to itineraries)" is an extremely broad activation condition that could apply to many ordinary travel-related conversations. It does not define clear boundaries or exclusions for when the skill should activate versus stay inactive, increasing the risk of unintended invocation.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 35)May include surrounding context.

sh

trap "rm -f $HEADER_FILE" EXIT

# Initialize session
curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  -D "$HEADER_FILE" \

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/mcp-call.sh (reported line 50)May include surrounding context.

sh

SESSION_ARGS=(-H "Mcp-Session-Id: ${SESSION}")
fi

curl -s -X POST "$URL" \
  -H "Content-Type: application/json" \
  -H "Accept: application/json, text/event-stream" \
  "${SESSION_ARGS[@]}" \

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

The manifest explicitly enumerates flights, hotels, Airbnb, car rentals, ferries, and specific providers supporting those categories. The roadmap's 'Train/bus suggestion for short hops (<500km)' introduces additional transport-planning behavior that is not represented in the manifest's description of supported modalities.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.