pricewin-flight-search

• Outcome: Review
• Latest audit: Aug 2, 2026 · 2:43 PM UTC
• Version: 1.0.0

Overview

This flight-search skill is not malicious, but its installer persistently registers a hosted MCP server across multiple local AI agents at once, so users should review the config changes before installing.

Install only if you are comfortable adding PriceWin's hosted MCP server to your local AI tools. Run `bash install.sh --dry-run` first, review which agent config files would change, and consider manually adding the server only to the one agent you intend to use. The skill does not appear to steal credentials or book/pay for flights, but travel search queries will go to PriceWin's hosted service.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 87% confidence
• Finding: The skill declares no permissions, yet its own instructions direct the user to run `bash install.sh`, and the description states that this script discovers agents and modifies multiple local configuration files. That is a real capability expansion beyond a passive prompt-only skill, and the lack of declared permissions reduces transparency and informed consent for local file modification and shell execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The advertised purpose is flight search, but the skill also performs host discovery, invokes local tools, and rewrites configuration for multiple agents to register a remote MCP endpoint. That mismatch is security-relevant because users may invoke or install it expecting a simple search helper, while it actually establishes persistent integration with a third-party remote service across their local AI tooling.

Agent Config Directory Access

High

• Category: Agent Snooping

Content

# Codex keeps TOML, which has no safe merge without a parser we can rely on, so we
# only ever append a block and only when it is absent.
merge_codex(){
  local file="$HOME/.codex/config.toml"
  [ -d "$HOME/.codex" ] || return 1
  if [ -f "$file" ] && grep -q "^\[mcp_servers\.${MCP_NAME}\]" "$file"; then
    say "OK $file (already registered)"

• Confidence: 91% confidence
• Finding: /.codex/config.toml

Agent Config Directory Access

High

• Category: Agent Snooping

Content

done <<EOF
$HOME/.cursor/mcp.json|url
$HOME/.codeium/windsurf/mcp_config.json|serverUrl
$HOME/.gemini/settings.json|httpUrl
EOF

# VS Code / Copilot uses the same file with a "servers" key instead.

• Confidence: 90% confidence
• Finding: /.gemini/settings.json

MCP Config Access

High

• Category: Agent Snooping

Content

merge_json "$cfg" mcpServers "$shape"
  fi
done <<EOF
$HOME/.cursor/mcp.json|url
$HOME/.codeium/windsurf/mcp_config.json|serverUrl
$HOME/.gemini/settings.json|httpUrl
EOF

• Confidence: 92% confidence
• Finding: mcp.json|url

MCP Config Access

High

• Category: Agent Snooping

Content

fi
done <<EOF
$HOME/.cursor/mcp.json|url
$HOME/.codeium/windsurf/mcp_config.json|serverUrl
$HOME/.gemini/settings.json|httpUrl
EOF

• Confidence: 92% confidence
• Finding: mcp_config.json|serverUrl

Session Persistence

Medium

• Category: Rogue Agent

Content

return 0
  fi
  [ -f "$file" ] && [ ! -f "$file.bak" ] && cp "$file" "$file.bak"
  mkdir -p "$HOME/.codex"
  {
    echo
    echo "[mcp_servers.${MCP_NAME}]"

• Confidence: 89% confidence
• Finding: mkdir -p "$HOME/.codex" { echo echo "[mcp_servers.${MCP_NAME}]" echo "url = \"${MCP_URL}\"" } >> "$file" say "ADDED $MCP_NAME in $file" } say "Registering MCP server '$MCP_NAME' ->

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.