Security audit

Tennis Vacation Rater

Security checks for vulnerabilities and agentic risk

Overview

This tennis travel skill is generally coherent, but it may access travel links or flight-price services and its price-monitoring wording is confusing.

Install only if you are comfortable with travel research that may use web search, open travel/social links you provide, or run an optional flight-price CLI if you allow it. Do not expect automatic daily flight monitoring from this skill; treat all price checks as one-time unless you separately configure a dedicated tracker.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The skill directs the agent to probe for and invoke a local CLI via shell commands (`which flyai`, then `flyai search-flight`) even though the manifest presents a travel-rating skill, not a system-integrated command runner. Expanding from content synthesis into local command execution increases attack surface, can surprise users, and creates a pathway for unintended access to host-installed tools or sensitive environment context.

Context-Inappropriate Capability

Low

Confidence: 76% confidence
Finding: The skill broadens scope by allowing browser automation or direct fetching of user-provided social links, which is not necessary for the core destination-rating task. While framed as optional and non-blocking, this still increases exposure to untrusted external content and may trigger access to sites with trackers, anti-bot challenges, or unexpected data flows.

Description-Behavior Mismatch

High

Confidence: 96% confidence
Finding: This guide adds a substantial flight-price monitoring and booking-advice workflow to a skill whose stated purpose is evaluating tennis vacation destinations. That scope expansion can cause the agent to collect travel-planning inputs and make airfare recommendations users did not explicitly request, increasing the chance of unintended tool use and misleading claims about capabilities.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: The file instructs the agent to use WebSearch or a CLI to check airfare and provide booking recommendations, which is outside the justified scope of a tennis destination rating skill. In context, that mismatch is risky because it encourages external lookups and transactional-style advice without the user invoking a dedicated airfare feature or being told that the skill supports it.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The guide tells users 'I'll monitor flight prices' and describes daily 9 AM checks and immediate notifications, but later claims there is no automatic monitoring and only one-time checks. This contradiction is dangerous because it can misrepresent the system's actual behavior, causing users to rely on monitoring or notifications that will never happen and potentially disclose personal travel details under false expectations.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs execution of shell commands and a third-party CLI without clearly warning the user that external commands may run on the host environment. Lack of transparency and consent is dangerous because users may unknowingly trigger local tool execution, with associated privacy, integrity, and environment-exposure risks.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrase 'or similar' is overly broad and can cause the price-monitoring flow to activate for loosely related statements rather than clear user intent. In this skill, that matters because the activated behavior is already out of scope, so ambiguity increases the likelihood of unsolicited airfare assistance and unnecessary collection of travel preferences.

Static analysis

No suspicious patterns detected.