Variflight Global Flight Fares

• Outcome: Pass
• Latest audit: Sep 15, 2026 · 12:05 AM UTC
• Version: 1.0.0

Overview

This skill is a narrow flight-fare lookup tool that makes a disclosed request to Variflight and does not show destructive, credential-stealing, persistent, or deceptive behavior.

Install this if you are comfortable with a skill that sends the route and travel date you provide to Variflight's ticket API. Do not provide sensitive personal details beyond the route/date needed for a fare lookup, and expect the default formatted output to be Chinese unless you request raw JSON or ask the agent to translate/summarize it.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

4. Run `python3 scripts/query_flights.py --dep BJS --arr SHA --date 2026-04-21`.
5. Summarize the result with departure airport, arrival airport, times, duration, price, transfer info, and the flight tag text.

## Output Rules

- Treat API `code != 0` as a failure and surface the returned `msg`.
- Treat an empty `data.list` as a valid "no flights found" result.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill invokes a bundled Python script that performs network access, but the manifest does not declare any explicit tool scope such as allowed tools or permissions. This creates a governance gap: an agent may execute network-capable code without clear restriction or review boundaries, increasing the risk of unintended outbound requests or future abuse if the script changes.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 28)May include surrounding context.

md

- Use `--limit N` when the user only wants a subset of results.
- Use `--json` only when the user asks for raw payload data.
- Mention transfer flights separately from direct flights when summarizing.
- Do not ask the user to provide an API key for this skill.

## Script

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script emits multiple user-facing strings in Chinese, including transfer labels and all formatted output, but provides no option to choose language or confirm the user's locale preference. This can violate language/locale policy requirements because the skill forces a specific language for all users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The natural-language default prompt is written entirely in Chinese, which imposes a specific language/locale choice by default. The file does not indicate that users may choose another language or that the Chinese locale is required for a region-specific purpose.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.