Hna 666 Flight Checker

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:31 PM UTC
• Version:
  1.0.0

Overview

This skill is a disclosed flight-availability checker that runs browser automation for Hainan Airlines searches, with setup and site-automation cautions but no evidence of theft, persistence, destructive behavior, or hidden data handling.

Install only if you are comfortable with an automated browser running local Python code and querying Hainan Airlines repeatedly. Verify the local Playwright environment path is trusted, and avoid using the alternate CAPTCHA-continuation script unless you have explicit permission to automate the site.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The skill explicitly instructs the agent to run a local Python script from a fixed filesystem path, but it does not warn the user that activating the skill causes local code execution. This creates a transparency and trust boundary problem: even if the script is intended for legitimate flight lookup, users may unknowingly trigger arbitrary local code with the agent's permissions, and the long timeout plus debug flag slightly increase exposure if the script is modified or abused.

VirusTotal

66/66 vendors flagged this skill as clean.