T09 · Insecure Skill Coding Practices
Warning
- Location
references/memory-structure.md:5- Finding
Persistent Plaintext Storage of Sensitive Identity, Medical, Financial, and Travel Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Atlas Travel Extras
Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is not malicious, but it should be reviewed because it encourages storing sensitive travel, identity, medical, and financial details in persistent plaintext files without clear safeguards.
Install only if you are comfortable keeping travel records in local markdown files. Avoid storing full passport, visa, booking, policy, card, medical, or device identifiers unless strictly necessary; prefer redacted values and an encrypted vault for document copies or high-risk personal data. Verify visa and entry requirements with official sources for your own nationality before relying on examples.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (12)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger list includes broad, common phrases such as 'weather', 'documents', 'insurance', 'accommodation', and 'visa' that are likely to match many unrelated user requests. This can cause unintended activation of the skill and unnecessary access to or display of travel-related memory, which is more concerning here because the skill manages sensitive itinerary and document data.
- Content
Shadow Command Trigger
Medium
- Category
- Trigger Abuse
- Confidence
- 82% confidence
- Finding
The trigger phrase 'find hotel' overlaps with a generic built-in verb pattern centered on 'find', which can shadow or intercept broader assistant behavior. In practice this may route unrelated discovery requests into this skill unexpectedly, creating confusion and increasing the chance that travel memory is used in the wrong context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill explicitly stores and processes passport validity, visas, insurance, bookings, and reminders, but the description provides no warning or guidance for handling sensitive personal travel data. Without clear limits on what should be stored or displayed, users or downstream agents may place excessive sensitive data into markdown files, increasing privacy and identity-risk exposure if those files are accessed or surfaced inadvertently.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
All headings, labels, and instructions are presented only in German, which imposes a language choice on users. Under the stated policy, a forced language without user opt-in or explicit justification is a natural-language policy violation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This template prompts users to record and keep readily accessible highly sensitive data, including medical details, insurance policy numbers, emergency contacts, document-copy locations, and device identifiers, but provides no guidance on minimization, redaction, or safe storage. If the card is lost, photographed, or accessed by an unauthorized person, it could enable identity theft, account/social-engineering abuse, privacy violations, or targeted fraud during travel.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file presents all instructions, reminders, and guidance only in German, which can be a natural-language locale constraint. Under the stated policy, forcing a specific language without user opt-in or a clearly documented regional justification can be a policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The file presents visa guidance that is valid only for German travelers without clearly labeling it as user-specific or prompting for nationality. In a travel-planning skill, users may incorrectly generalize this advice to themselves, leading to missed visa requirements, denied boarding, or entry issues.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
This markdown template asks users to record booking numbers and later insurance policy numbers, which can be sensitive travel-related data. The file provides no warning or note about avoiding real identifiers in shared documents or handling the data carefully.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The markdown includes dedicated 'Buchungs-Nr' fields for accommodations and activities, encouraging users to store potentially sensitive reservation identifiers. Because there is no warning about privacy, sharing, or redaction, the description omits guidance for behavior that could affect user data privacy.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
This markdown file contains user-facing instructions exclusively in German, and there is no indication that the skill is intended only for German-speaking users or a specific locale. Under the policy rule for language/locale, forcing a single language without opt-in can be a natural-language policy violation.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file is entirely in German, including headings and checklist items, and does not indicate that the skill is intentionally limited to German-speaking users or provide any opt-in for language preference. That can violate language/locale policy when a skill implicitly forces a specific language for all users.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
This markdown file uses German throughout, including the title, section headings, and field labels, but does not indicate that German is optional or that the template is intended only for German-speaking users. Under the policy rule for natural-language constraints, forcing a specific language without user opt-in can be a locale policy violation.
- Content
Static analysis
No suspicious patterns detected.