Security audit

Cyber Travel

Security checks for vulnerabilities and agentic risk

Overview

This travel-journal skill is coherent and purpose-aligned, but users should be aware it stores trip files, retrieves images, and adds fixed PDF branding.

Install only if you are comfortable with the agent creating local trip-memory files and saving images for this workflow. Review generated PDFs for unwanted fixed branding, and prefer user-provided or properly licensed photos if you plan to share the output publicly.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

Findings (1)

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:99
Finding: Mandatory Branding Injected into Generated PDF Output
Content: View full analysis
🦊 赛博旅行者：小爪子 | 生成工具：Cyber Travel Skill ``` ### Technical Analysis The skill declares its PDF template mandatory and includes a fixed footer that promotes a named persona and the skill itself. The attribution is unrelated to the core task of generating a travel journal and cannot be disabled through the documented workflow. When the skill is loaded, this instruction changes the agent's output behavior by requiring attacker-selected branding in every generated PDF. This is a limited form of skill instruction hijacking affecting output integrity. It does not override safety controls, execute code, access credentials, or modify system permissions. ### Attack Path 1. A user or agent loads the Cyber Travel skill. 2. The user requests a travel journal in PDF format. 3. The skill requires the agent to use the supplied HTML template. 4. The mandatory footer is copied into the generated HTML. 5. The resulting PDF contains the fixed persona and skill branding, even if the user did not request attribution. ### Impact Assessment The impact is confined to generated PDF content: - Unauthorized attribution or promotional text is inserted into the final artifact. - Users cannot obtain neutral, unbranded PDF output while following the skill instructions. - Documents may incorrectly imply authorship, endorsement, or association with the named persona or skill. No additional operating-system privileges, persistent execution, credential access, code execution, or cross-session control can be obtained through this behavior. The scope is therefore limited to output integrity and presentation. ]]>
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The entire skill specification, required output structure, and template content are written as mandatory Chinese-language instructions, and there is no indication that users may choose another language. The policy requires flagging language or locale constraints when a specific language is imposed without user opt-in.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill explicitly instructs the agent to write plans, daily logs, checkpoints, and summaries to persistent local memory paths without any user notice or consent step. Even though the content is travel-related, it may include user preferences, schedules, fetched media, and generated artifacts that create privacy, storage, and persistence risks if saved automatically.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill directs the agent to search for and save real photos from external sources, but does not address copyright, licensing, hotlinking, privacy, or the implications of retrieving third-party content. This can lead to unauthorized reuse of images, storage of externally sourced media, and possible inclusion of personal data from images without safeguards.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.