Travel Buddy

• Outcome: Pass
• Latest audit: Oct 12, 2026 · 8:17 AM UTC
• Version: 2.9.0

Overview

Travel Buddy is a local-first travel planning skill with disclosed profile storage, local forms, validation scripts, and travel-related network checks; no hidden exfiltration, booking, payment, or destructive behavior was found.

Install only if you are comfortable with a travel skill storing opt-in profile and trip files on your machine, opening local 127.0.0.1 intake forms, and making travel-related web requests. Do not put passport numbers, payment details, passwords, or exact home addresses into it; review any saved profile path before deleting it manually, and only use --assistant codex or --assistant claude when you intentionally want it to start a separate planner process.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (303)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

The README instructs users to delete a profile via a shell rm command with a placeholder path. Even though it warns to remove only one file, copy-paste modification of destructive shell commands is error-prone and can lead to unintended local data loss, especially if users expand or alter the path incorrectly. In this skill context, the danger is moderate because the command targets user-owned local files and the documentation explicitly cautions against deleting the whole workspace, but it still promotes a hazardous manual pattern.

Content

Scanner excerpt · README.md (reported line 225)May include surrounding context.

Deleting a profile is deliberately manual — there is no forget subcommand. Confirm the exact resolved path, then remove that one file:

bash

rm "~/Travel Buddy/profiles/<the-one-you-named>.json"

Never remove the whole workspace to satisfy a profile deletion.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The README instructs users to manually run rm "~/Travel Buddy/profiles/<你点名的那个>.json" to delete a profile. Because shell quoting prevents ~ expansion in many shells, users may modify the command ad hoc, and any workflow that substitutes an unvalidated user-provided filename into a destructive shell command creates a real risk of deleting the wrong file or encouraging unsafe command construction. In the context of a skill that manages local files, destructive file-operation guidance is more dangerous because users are likely to copy-paste it directly.

Content

Scanner excerpt · README_CN.md (reported line 233)May include surrounding context.

删除档案是刻意手动的 —— 没有 forget 子命令。先确认解析出的确切路径，再删那一个文件：

bash

rm "~/Travel Buddy/profiles/<你点名的那个>.json"

绝不能为了删一个档案而清掉整个工作区。

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description significantly understates and mischaracterizes the skill's actual behavior: it can inspect local workspaces, mutate plan files, audit prior artifacts, perform outbound network probing, fetch external content, and manage deliverable pipelines. This is dangerous because users and policy systems may invoke a seemingly benign travel-planning skill without realizing it has broad file-system, network, and post-processing capabilities beyond ordinary itinerary assistance.

Content

No source excerpt is available for this finding.