航班搜索

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:03 AM UTC
• Version: 1.0.1

Overview

This skill is a straightforward flight-search helper that queries a fixed Variflight endpoint and does not show hidden, destructive, persistent, or credential-seeking behavior.

Before installing, be aware that using the skill will send your requested route and date to Variflight's ticket API and that formatted script output is primarily Chinese. No API key should be provided for this skill.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

4. Run `python3 scripts/query_flights.py --dep BJS --arr SHA --date 2026-04-21`.
5. Summarize the result with departure airport, arrival airport, times, duration, price, transfer info, and the flight tag text.

## Output Rules

- Treat API `code != 0` as a failure and surface the returned `msg`.
- Treat an empty `data.list` as a valid "no flights found" result.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill invokes a bundled Python script that performs outbound network access, but the manifest does not declare any explicit tool scope such as permissions or allowed-tools. This weakens sandboxing and review controls because consumers cannot easily tell that external network activity is required, increasing the chance of unintended data exposure or policy bypass in environments that rely on manifest-declared capabilities.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- Use `--limit N` when the user only wants a subset of results.
- Use `--json` only when the user asks for raw payload data.
- Mention transfer flights separately from direct flights when summarizing.
- Do not ask the user to provide an API key for this skill.

## Script

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This script emits multiple user-facing strings in Chinese, including transfer labels and all formatted output lines, but provides no option to select language and no documentation that the skill is intentionally Chinese-only. That creates a natural-language policy concern because the skill implicitly forces a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.