Search and Book Flights

• Analyzed: May 12, 2026, 3:16 AM
• Findings: 1
• Version: 2.4.1
• Hash: e421872bfb10cd7faf278b0306fe39d1b5d47614cf57f781ae411d6dac29e54d
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is designed for legitimate travel booking, leveraging existing agent email and web browsing permissions. It explicitly states it does not store or transmit credentials, and consistently emphasizes the requirement for explicit human approval for all sensitive actions, including account creation, PII entry, and payment. There is no evidence of prompt injection attempting to subvert the agent, exfiltrate data, execute malicious commands, or establish persistence. The high-risk capabilities (email, web forms) are inherent to the stated purpose and are handled with transparency and a strong focus on human consent, aligning with a benign classification.