Travel Buddy

• Outcome: Pass
• Latest audit: Aug 5, 2026 · 1:48 AM UTC
• Version: 0.1.0

Overview

Travel Buddy is a disclosed local-first travel planning skill that saves user-approved travel profiles and plans, with no evidence of hidden exfiltration, transactions, or destructive behavior.

Install only if you are comfortable with a local travel-planning workflow that stores opt-in profile data and plan files on your machine, opens loopback intake forms, performs web research, and may start a new Codex or Claude task after you submit the trip form. Use --assistant none if you want to prevent automatic continuation.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill instructs the agent to use shell commands, local file reads/writes, and network-backed research workflows, yet it declares no permissions. That mismatch is dangerous because users and host systems cannot accurately assess what the skill may do, especially since it handles local profile storage and can launch automated subprocesses that read and persist traveler data.

Intent-Code Divergence

Medium

• Confidence: 99% confidence
• Finding: The valid_profiles function inverts the validation check and appends profiles when validate_profile(profile) returns false. This causes malformed or untrusted profile files to be treated as valid workflow inputs, undermining the trust boundary for later intake and planning steps and potentially causing downstream logic failures or unsafe data handling.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README states that merely describing a trip such as 'help me find somewhere warm for a week in March' is enough to trigger the skill. Broad natural-language activation can cause unintended invocation of a skill that opens a local intake server and begins autonomous workflow steps, increasing the chance of accidental collection of personal travel data or unexpected execution in mixed conversations.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The README says that simply describing a travel need like '帮我找个三月份暖和的地方待一周' is enough to trigger the skill. In an agent environment, such broad trigger language can cause unintended activation during ordinary conversation, leading the skill to start local workflows, open loopback forms, or persist planning data without the user clearly intending to invoke this specific skill.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- Use [templates/personal-travel-profile.json](templates/personal-travel-profile.json) and read [references/profile-and-storage.md](references/profile-and-storage.md) before creating, loading, updating, or forgetting a profile. Reuse `digital_travel_access` only as a convenience preference: map/booking apps, services to avoid, normal Google-service access, and non-sensitive booking-access notes; never store account context.
- Initialize a workspace with `python scripts/travel_workspace.py init`; create a consented empty profile only after opt-in with `python scripts/travel_workspace.py create-profile <profile-id> --consent`; validate it before use.
- For the normal guided flow, start `python scripts/start_intake_workflow.py --assistant auto` and provide the loopback link printed in the terminal. It starts the one-time profile HTML only when no valid profile exists; after save, it starts the current-trip service first and redirects the same browser tab to its prefilled HTML. The terminal prints the second local URL as a fallback. After a valid current-trip submission, the service launches a new non-interactive Codex or Claude destination-discovery task automatically; it reads the saved intake and prints the shortlist in that same terminal. `auto` detects the active runtime; use `--assistant codex` or `--assistant claude` when invoking from a known runtime, and use `--assistant none` only when automatic continuation must be deliberately disabled. Never resume the generic “last” CLI session because it may be an unrelated trip. If multiple profiles exist, ask the user to choose one by ID and rerun with `--profile PROFILE_ID`. Do not ask the user to download, move, upload, paste JSON, or type “continue”.
- When exactly one valid profile exists, the workflow reuses it silently. Do not let that pass unnoticed: **summarize the loaded profile's relevant fields and ask whether anything changed before starting the trip form.** If the traveller wants changes, rerun with `python
...[truncated 26 chars]

• Confidence: 84% confidence
• Finding: Do not ask the user

VirusTotal

63/63 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.