Travel Concierge CLI

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:49 AM UTC
• Version: 1.5.0

Overview

The skill is openly about finding accommodation contacts and placing AI phone calls, but it asks for sensitive service credentials and can make real calls through multiple providers without enough scoping, consent, or privacy guidance.

Review this carefully before installing. Only use it if you are comfortable giving it telephony, AI, and tunnel-provider credentials, making real calls that may cost money, and sending call audio/transcripts plus booking details to third-party services. Confirm legal consent and disclosure requirements for AI-assisted or recorded calls, restrict it to intended accommodation workflows, and prefer a pinned, auditable package version with tightly protected API keys.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:4
• Finding: Unpinned External Package Installation Creates a Supply-Chain Risk## Vulnerability Details **File Location**: `README.md`, lines 4-7 **Vulnerability Type**: Unpinned third-party executable dependency **Risk Level**: Medium **Vulnerable Code Snippet**: ```bash ## Installation skill install @skillhq/concierge ``` ### Technical Analysis The installation instructions retrieve `@skillhq/concierge` without specifying an exact version or integrity digest. Consequently, the package resolved at installation time can change after this artifact has been reviewed. The supplied project does not include the concierge implementation, a dependency manifest, or a lockfile. The only TypeScript file is a Vitest configuration that refers to absent `src/` and `tests/` directories. Therefore, the behavior of the externally installed package—including its handling of credentials, local processes, network tunnels, and phone calls—cannot be verified from this artifact. This becomes exploitable if the package publisher, registry account, distribution infrastructure, or a future package release is compromised. It is not evidence that the current external package is malicious; the vulnerability is the lack of reproducible, integrity-verified installation. ### Attack Path 1. An attacker compromises the package publisher, registry account, or package distribution channel, or causes a malicious future release to be selected. 2. The user follows the documented command `skill install @skillhq/concierge`. 3. Because no version or integrity digest is pinned, the installer resolves and installs the attacker-controlled release. 4. The installed package executes with the invoking user's permissions. 5. The user configures the package with Twilio, Deepgram, ElevenLabs, Anthropic, Google Places, or ngrok credentials. 6. Malicious package code reads those credentials, modifies local files accessible to the user, opens unauthorized tunnels, or abuses paid calling and AI services. ### Impact Assessment Successful e ...[truncated 593 chars]
• Remediation: ## Remediation Suggestions 1. Pin the installation to an exact, reviewed package version rather than resolving the latest available release. 2. Verify the package using a cryptographic integrity digest or signed release provenance. 3. Include the complete implementation, dependency manifest, and lockfile in the auditable artifact. 4. Use a trusted registry with protected publisher accounts, mandatory multi-factor authentication, and controlled release permissions. 5. Run the package with least privilege and restrict access to `~/.config/concierge/config.json5` using owner-only filesystem permissions. 6. Prefer operating-system credential storage or a dedicated secret manager over plaintext configuration for service tokens. 7. Add automated dependency and provenance verification to release and installation workflows. 8. Document credential rotation procedures and monitor Twilio and other service accounts for unexpected usage.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared purpose describes a user-facing capability for locating property contact information and placing booking-related calls. However, the supplied code only configures the Vitest testing framework: it defines the test environment, included test files, and coverage reporting settings. It does not implement any contact search, booking, calling, scraping, API access, or communication behavior. This is a clear description-behavior mismatch because the actual code is unrelated infrastructure/testing configuration rather than the declared accommodation contact and booking functionality.

Vague Triggers

High

• Confidence: 97% confidence
• Finding: The trigger list includes very generic terms like 'call', 'phone', and 'dial', which are likely to match routine user requests and cause this skill to activate unexpectedly. Because the skill can initiate real-world phone calls and transmit user-supplied identity and booking details to Twilio, Deepgram, ElevenLabs, and an LLM, accidental invocation materially increases the risk of unintended charges, privacy exposure, and unauthorized external actions.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The outbound calling examples instruct users to place AI-mediated calls without any warning about consent, call recording, disclosure, or privacy requirements. In a voice automation context, this is especially risky because users may deploy the system against real businesses or individuals without understanding legal and ethical obligations around notification and personal data collection.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The guide includes a restaurant-reservation calling example even though the skill is described as accommodation-focused. This broadens the apparent operational scope of the agent and normalizes use for general outbound AI calling, increasing the chance of misuse beyond the user’s expected consent boundary and declared purpose.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The architecture and security notes describe routing live call audio, transcripts, and AI responses through Twilio, Deepgram, Anthropic, and ElevenLabs, but the guide does not clearly warn users that sensitive voice content is transmitted to multiple third-party processors. This can lead to uninformed handling of personal data, booking details, and potentially regulated or confidential information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README promotes autonomous AI phone calls that can contact real third parties and continue conversations until a goal is achieved, but it does not prominently warn users that this may place real calls, incur charges, and interact with unsuspecting humans on the user's behalf. In the context of a booking/calling skill, that omission increases the risk of misuse, accidental harassment, privacy issues, and unauthorized real-world actions.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install ffmpeg ngrok

# Ubuntu/Debian (including ARM VPS)
sudo apt-get update
sudo apt-get install -y ffmpeg
# install ngrok from ngrok docs, then verify `ngrok version`
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

brew install ffmpeg ngrok

# Ubuntu/Debian (including ARM VPS)
sudo apt-get update
sudo apt-get install -y ffmpeg
# install ngrok from ngrok docs, then verify `ngrok version`
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Shadow Command Trigger

Medium

• Category: Trigger Abuse
• Confidence: 70% confidence
• Finding: Shadow Command Trigger: 'find contact' conflicts with built-in command 'find'

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill instructs users to provide personal data such as name, email, and customer phone number, and to use third-party providers including Twilio, Deepgram, ElevenLabs, and Anthropic, but it does not clearly warn that this data will be transmitted to those external services during autonomous calls. Users may unknowingly expose PII and booking details to multiple processors, creating privacy, compliance, and consent risks.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill documentation describes collecting and using names, emails, phone numbers, goals, and context for autonomous calls, but it does not clearly warn users that this data will be sent to multiple third-party providers for telephony, transcription, synthesis, and model inference. In this context, the omission is security-relevant because users may unknowingly disclose sensitive personal or booking information to external services and over phone channels.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: The skill states that the `call` command auto-starts `ngrok` and a local call server if needed, but the description does not present this as a prominent operational warning. Automatically launching network-exposed infrastructure can surprise users, expand attack surface, and create unintended external exposure if the user does not understand what processes are being started.

Static analysis

No suspicious patterns detected.