Security audit

Trip Planner 0→1

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent travel-planning workflow, but its optional sync and deployment examples can expose travel data or service credentials if used as written.

Use the skill only after reviewing each generated artifact before syncing or sharing it. Keep the default localStorage mode when possible, do not paste GitHub PATs or JSONBin master keys into browser code, use high-entropy room IDs, add real authentication before deploying any sync backend, and remove confirmation numbers, order IDs, credit-card details, passport notes, and emergency contacts from any public URL.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (14)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 84% confidence
Finding: The skill clearly directs the agent to use network-capable resources such as Web search, map APIs, Xiaohongshu MCP, deployment platforms, and optional cloud sync backends, but no permissions are declared. That creates a least-privilege and consent gap: an agent may perform outbound requests, data persistence, or publishing-related actions without an explicit permission boundary visible to users or the runtime.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The top-level description frames the skill as itinerary planning, but the body also defines persistent storage, cross-device synchronization, external API writes, deployment, and client-side interactive state management. This mismatch is security-relevant because users may authorize a planning skill without realizing it can write data to third-party services or publish/share artifacts externally.

Context-Inappropriate Capability

Medium

Confidence: 78% confidence
Finding: The skill instructs configuration of a Xiaohongshu MCP server described as supporting content retrieval and publishing, even though trip planning only requires retrieval. Including publishing capability unnecessarily broadens the agent's power and could enable unintended posting or account actions if the MCP server is connected with authenticated credentials.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The documented Worker exposes a public GET/POST API with `Access-Control-Allow-Origin: *` and no authentication by default, so anyone who knows or can guess a room ID can read and overwrite synced Todo data. In the context of a trip-planning skill, this can disclose travel plans and permit unauthorized tampering, and the optional security section is too weak because the insecure design is presented as the default recommended path.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The sample service allows anyone who can guess a room ID to read and overwrite stored state, and it explicitly enables cross-origin access from any website via `Access-Control-Allow-Origin: *`. In the context of a travel-planning sync backend, this is broader than necessary and turns the service into unauthenticated public storage, enabling data tampering, unauthorized reads, and abuse by arbitrary third-party web pages.

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The document emphasizes binding Node to `127.0.0.1` as a safety measure, but the provided nginx configuration republishes the endpoint to the public internet without any corresponding authentication or access restrictions. This can mislead deployers into thinking the service is not externally exposed when in practice it becomes reachable by anyone through the reverse proxy.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The README advertises very broad trigger phrases such as generic travel-planning requests, which can cause the skill to activate in situations the user did not explicitly intend. In agent environments, overbroad invocation increases the chance of unnecessary tool use, data access, or workflow execution beyond the user's expectations.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The README promotes external data sources and optional cloud sync backends but does not warn users that itinerary details, preferences, locations, or other trip data may be transmitted to third-party services. This creates a privacy and compliance risk because users may unknowingly expose sensitive travel or personal information to external systems.

Vague Triggers

Medium

Confidence: 74% confidence
Finding: The trigger list is very broad and includes common phrases such as itinerary, route planning, and travel plan, which can cause accidental invocation. Mis-triggering matters here because this skill can initiate broad research, collect user trip details, and potentially lead into sync/deployment flows that are more invasive than a user may expect from a casual request.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The document gives copy-pastable deployment instructions for a public sync backend without clearly warning that room IDs function as the only gate and can be guessed, shared, or brute-forced. Because this is operational guidance, users are likely to deploy it as-is, creating exposed storage where trip data can be read or modified by unauthorized parties.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The template includes fields for a GitHub Personal Access Token and a JSONBin master key directly in client-side configuration, encouraging users to paste long-lived secrets into JavaScript that runs in the browser. In this context, any embedded secret is exposed to anyone who can view source or use developer tools, enabling unauthorized access to the associated third-party account or data store.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: When non-local backends are enabled, the code uploads todo state, timestamps, and a truncated user-agent string to third-party services without any explicit consent flow or prominent disclosure to the end user. Although the data is not highly sensitive by default, travel todo items can reveal plans, timing, and personal behavior, and silent transmission increases privacy and compliance risk.

Credential Access

High

Category: Privilege Escalation
Content: ### 方案 B：GitHub Gist（零服务器，需 GitHub 账号） - 把勾选状态 POST 到一个 public Gist - 用 Personal Access Token（只需 `gist` 权限） - 代码模板见 `references/templates/todo-sync.js` 的 Gist 变体 ### 方案 C：JSONBin.io / jsonbin.io（零服务器，免费 1 万次/月）
Confidence: 91% confidence
Finding: The skill instructs use of a GitHub Personal Access Token and other service keys for browser-based or client-side sync patterns. Embedding or handling long-lived tokens in a generated static webpage or client workflow risks credential exposure to the agent, browser, source repository, page viewers, and any script running in that origin; if leaked, attackers could read or modify synchronized data and potentially abuse the connected account scope.

Credential Access

High

Category: Privilege Escalation
Content: // GitHub Gist 配置（仅 SYNC_BACKEND='gist' 时） const GIST_CONFIG = { token: 'ghp_xxx', // Personal Access Token（scope: gist） gistId: '', // 首次留空，自动创建；后续填写 Gist ID filename: SYNC_ROOM + '.json', };
Confidence: 98% confidence
Finding: The code explicitly instructs use of a GitHub Personal Access Token in browser-side JavaScript. In a static travel-planning skill that may be deployed to public hosting, this is especially dangerous because viewers can trivially recover the token and use it to read, modify, or create gists within the token's scope.

VirusTotal

63/63 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.