Ticket Price Compare

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 6:54 AM UTC
• Version: 1.2.7

Overview

This skill does what it claims: compares flight and train prices using disclosed travel websites and optional API keys, with some setup and privacy cautions for users.

Install only if you are comfortable sending travel route and date details to the listed travel services. Avoid permanent plaintext API-key setup where possible, and use temporary environment variables or a secret manager. Treat the optional Amadeus SDK install as higher risk unless pinned or installed in an isolated environment.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: README.md:159

Finding

Unpinned Third-Party Amadeus SDK Installation

Content

View full analysis

Vulnerability Details

File Location: README.md, line 159
Vulnerability Type: Unpinned third-party dependency
Risk Level: Medium

Vulnerable Code

bash

pip install amadeus>=12.0.0

Technical Analysis

The installation instructions allow pip to select any Amadeus SDK release at or above version 12.0.0. No exact version, package hash, lock file, or reviewed artifact is specified.

Consequently, the code that users install can change after the Skill has been audited. If the package publisher, package repository, dependency resolution configuration, or a future compatible release is compromised, an attacker-controlled release could be selected automatically. Python packages can execute code during installation and whenever imported by scripts/ticket_search.py.

No evidence indicates that the current Amadeus package is malicious. The confirmed weakness is the lack of dependency immutability and integrity verification.

Attack Path

1. An attacker compromises the Amadeus package publishing account, package repository, or another relevant supply-chain component.
2. The attacker publishes a malicious version satisfying the >=12.0.0 constraint.
3. A user follows the documented installation command.
4. pip resolves and installs the malicious compatible release.
5. Malicious code executes during installation or when ticket_search.py imports the SDK.
6. The code accesses resources available to the installing user, potentially including the Amadeus credentials configured for the Skill.

Impact Assessment

Successful exploitation could result in arbitrary code execution with the privileges of the user running pip or the Skill. The affected scope could include:

• Files and credentials accessible to that user.
• AMADEUS_CLIENT_ID and AMADEUS_CLIENT_SECRET.
• Other environment variables inherited by the process.
• Network access available to the Python process.
• Modificati ...[truncated 193 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the SDK to an exact, reviewed version:

   text

   amadeus==REVIEWED_VERSION
   

2. Place optional dependencies in a dedicated lock file rather than using an unconstrained command in documentation.
3. Record cryptographic hashes and require their verification:

   bash

   python -m pip install --require-hashes -r requirements.lock
   

4. Review the pinned package artifact and its transitive dependencies before publishing the lock file.
5. Use an isolated virtual environment and avoid running package installation as an administrator or root user.
6. Establish a controlled update process in which package upgrades are reviewed, tested, and assigned new hashes before release.

T09 · Insecure Skill Coding Practices

Note

• Location: README.md:93

Finding

Persistent Plaintext Storage of Firecrawl API Credentials

Content

View full analysis

Vulnerability Details

File Location: README.md, lines 93–117
Vulnerability Type: Insecure persistent secret storage
Risk Level: Low

Vulnerable Code

Linux / macOS:

bash

echo 'export FIRECRAWL_API_KEY="fc-your-actual-api-key-here"' >> ~/.bashrc
source ~/.bashrc

Windows CMD:

cmd

setx FIRECRAWL_API_KEY "fc-your-actual-api-key-here"

Windows PowerShell:

powershell

[Environment]::SetEnvironmentVariable("FIRECRAWL_API_KEY", "fc-your-actual-api-key-here", "User")

Technical Analysis

The permanent setup instructions encourage users to store a reusable Firecrawl API key in plaintext shell configuration or a persistent user-level environment variable.

On Linux and macOS, the key is written directly to ~/.bashrc, where it can be exposed through configuration-file disclosure, backups, synchronization tools, support bundles, or another process operating under the same user account. Persistent environment variables on Windows can likewise be read by software running in the user’s security context and may be captured by diagnostics or backups.

Environment variables are appropriate for injecting secrets into a process, but persistent plaintext environment configuration is not equivalent to secure secret storage. The documentation does not warn users about this exposure or recommend an operating-system keychain or secret manager.

Attack Path

1. A user follows one of the documented permanent configuration methods.
2. The Firecrawl API key remains stored in plaintext in shell configuration or the user environment.
3. Another process running as the same user, a configuration backup, a diagnostic archive, or an accidental file disclosure obtains the stored value.
4. An attacker extracts the reusable API key.
5. The attacker submits requests to Firecrawl using the victim’s account and quota until the key is revoked or expires.

Impact Assessment

Th ...[truncated 514 chars]

Remediation

View remediation

Remediation Suggestions

1. Prefer session-scoped secret injection rather than permanent plaintext configuration.
2. Recommend an operating-system keychain, credential manager, or dedicated secret-management service.
3. If environment variables must be used, load them at runtime from a protected secret store rather than writing literal values into shell startup files.
4. Add a prominent warning that shell profiles and persistent user environment variables store secrets in recoverable plaintext.
5. On Unix-like systems, require restrictive permissions for any fallback secret file:

   bash

   chmod 600 /path/to/secret-file
   

6. Document Firecrawl key rotation and revocation procedures.
7. Advise users to use a dedicated, least-privileged API key with spending or quota limits where supported.
8. Avoid printing secret values in verification steps, logs, examples, or error messages.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match

Findings (11)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

• Category: YARA Match
• Confidence: 75% confidence

Finding

YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).

Content

Scanner excerpt · README.md (reported line 95)May include surrounding context.

h scrape = 1 credit)

Step 2: Get Your API Key

1. After login, go to the Dashboard
2. Copy your API Key (format: fc-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx)

Step 3: Set Environment Variable

Linux / macOS (temporary, current session only):

bash

export FIRECRAWL_API_KEY="fc-your-actual-api-key-here"

Linux / macOS (permanent, add to ~/.bashrc or ~/.zshrc):

bash

echo 'export FIRECRAWL_API_KEY="fc-your-actual-api-key-here"' >> ~/.bashrc
source ~/.bashrc

Windows CMD (temporary, current window only):

cmd

set FIRECRAWL_API_KEY=fc-your-actual-api-key-here

Windows CMD (permanent, system-level):

cmd

setx FIRECRAWL_API_KEY "fc-your-actual-api-key-here"

Note: setx takes effect in new terminal windows, not the current one.

Windows PowerShell (temporary, current session only):

powershell

$env:FIRECRAWL_API_KEY = "fc-your-actual-api-key-here"

Windows PowerShell (permanent, user-level):

powershell

[Environmen

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/ticket_search.py (reported line 1370)May include surrounding context.

python

return []

    def _get_access_token(self):
        """Obtain OAuth2 access token from Amadeus."""
        if self._token and time.time() < self._token_expires:
            return self._token

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The feature summary highlights multi-source flight comparison and Firecrawl/Ctrip integration but does not clearly warn users that itinerary details such as origin, destination, and date may be transmitted to third-party services. In an AI skill setting, silent sharing of travel queries can expose sensitive personal or business travel patterns and defeats informed consent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises very broad natural-language auto-trigger phrases such as generic requests for flights or prices without defining clear activation boundaries, confirmation requirements, or scope limits. In an agent skill context, this can cause the skill to activate on ordinary travel-related conversations and initiate external lookups or link generation unexpectedly, increasing privacy and prompt-routing risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The v1.2.6 notes state that all ssl.CERT_NONE code was removed and there is no way to disable SSL verification. However, later in the same document the v1.2.5 notes describe an implementation with an opt-in unverified SSL fallback via TICKET_ALLOW_UNVERIFIED_SSL. Because this file is documentation-only and references conflicting implementation states, it creates intent/documentation divergence about whether insecure SSL behavior exists.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill advertises very broad trigger scenarios such as generic requests to search for cheap flights, compare prices, or find deals, which increases the chance of unintended activation in normal travel conversations. That can cause the agent to invoke networked behavior and share user itinerary details with external services when the user did not explicitly ask to use this skill.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill routes travel queries to multiple third-party domains, including scraping/rendering services and travel platforms, but the user-facing description does not clearly warn that origin, destination, date, and related query data may be transmitted externally. This creates a privacy and consent risk because users may disclose sensitive travel plans without understanding that their data will be shared across several services.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/ticket_search.py (reported line 589)May include surrounding context.

python

Falls back gracefully if not configured.
    """

    API_URL = "https://api.firecrawl.dev/v2/scrape"

    def __init__(self):
        self.api_key = os.environ.get("FIRECRAWL_API_KEY", "")

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 25% confidence

Finding

The only applicable policy category for this markdown file beyond warnings is natural-language policy violations, specifically language or locale constraints. Line L66 mentions an "IMPORTANT" directive in SKILL.md, but it does not itself impose a language or locale restriction, so this is at most a weak signal and likely not a true violation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

SQP-3 applies to all file types and covers language or locale policy violations. This document presents all instructions and platform guidance in a single language with no user opt-in or stated justification for the language choice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The request headers explicitly prefer zh-CN over other languages, which steers returned content toward Chinese. Elsewhere the script also emits Chinese-only user-facing text, and there is no documented opt-in or configurable language selection for users who may prefer another locale.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.