Security audit

Voyagier CLI

Security checks for vulnerabilities and agentic risk

Overview

This skill is a clearly disclosed Voyagier travel-booking CLI guide, with expected credential use and real-booking safeguards, but users should treat the external npm install and token configuration carefully.

Before installing, use a pinned and trusted @voyagier/cli version, protect the Voyagier PAT like a password, avoid custom API endpoints unless you control them, and require explicit user approval before any book or send command because those can create charges or email clients.

A.I.G

Vulnerability Patterns

Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:16
Finding: Unpinned npm Package Retrieval and Execution
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:24
Finding: Authentication Token May Be Sent to a Configurable API Endpoint
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 27)May include surrounding context.
voyagier doctor --json # verify auth + schema + state + version

text
Get a PAT: voyagier.com → Settings → Personal Access Tokens → Create. Or use env vars for CI/scripts: ```bash

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 122)May include surrounding context.
md
- Never output PAT tokens in command output. - Confirm with the user before `book` and `send` (real charges / real client email). - Credentials stored at `~/.voyagier/credentials.json` (mode 0600). - `--dry-run` on `book` previews without creating a checkout.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The skill recommends zero-install execution via npx @voyagier/cli without pinning an exact version. That causes agents or users to fetch and execute whatever package version is current at runtime, increasing supply-chain risk if a malicious or compromised release is published.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.