ClawHub
Back to skill

Security audit

Travel Advisor — Peak-End Experience Design

Security checks for vulnerabilities and agentic risk

Overview

This is a non-executable travel-planning guidance skill with disclosed, purpose-aligned behavior and no evidence of credential use, persistence, or hidden actions.

Install this if you want travel-planning help that emphasizes memorable client experiences, surprise touches, and referral timing. For neutral budget or logistics planning, be aware that the skill may steer suggestions toward emotional highlights and repeat-client outcomes.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (2)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The activation text is broad enough to match many normal travel-planning requests, especially subjective phrases like 'want remembered and referred' or 'setting surprise-and-delight touches.' In an agentic system, vague triggers can cause the skill to activate outside its intended scope, steering outputs toward upsell/referral optimization when the user may only want neutral planning help.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The repeated 'Activate when' and 'Do NOT activate when' guidance remains subjective and under-specified, which increases the chance of inconsistent or over-broad triggering. Because this skill changes how itineraries are designed around emotional peaks and referral asks, accidental activation can bias recommendations, budget allocation, and customer treatment without clear user intent.

Static analysis

No suspicious patterns detected.