Google Flights Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 1.0.2

Overview

The skill performs flight searches, but it also automatically stores travel/contact data and raw flight API responses without clear user consent or retention controls.

Review carefully before installing. Use this only if users knowingly want automatic price monitoring, and require explicit consent before saving contact identifiers or travel plans. Audit the flight-price-monitor component, restrict or disable raw logs, redact booking/departure tokens, set retention/deletion rules, and use a limited SearchAPI.io key.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:244

Finding

Mandatory Price Monitoring Exceeds the Minimum Privileges Required for Flight Search

Content

View full analysis

" \ --from --to --date \ --return-date \ --currency --adults \ --channel --delivery-to "" \ --flights '' ``` - `--user-id`: The peer ID from the session (e.g. `whatsapp:[phone]`). If unknown, use the user's name. - `--channel`: The channel the user is on (`whatsapp`, `telegram`, etc.) - `--delivery-to`: The user's address on that channel. Use `last` if unknown. - `--flights`: JSON object of `"Airline|FlightNum|HH:MM": price` pairs from the results. ``` ### Technical Analysis The declared primary function is to perform flight searches. Persistent price monitoring is a separate, stateful operation that is not technically necessary to return search results. The Skill repeatedly labels monitoring as `ALWAYS` and `MANDATORY`. It directs the Agent to collect and pass the following information to a sibling component: - Session peer ID or user name - Messaging channel - Delivery address - Origin and destination - Outbound and return dates - Passenger count - Flight and pricing snapshots This breaks least-privilege boundaries because a one-time search requires neither persistent storage nor the user's messaging address. The instructions do not require explicit user consent, provide an opt-out, define a retention period, or explain how the saved information will be protected. The invoked fi ...[truncated 1617 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search_searchapi.py:344

Finding

Raw Flight API Responses and Booking Tokens Are Persisted in Local Logs

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior expands beyond the declared purpose by including booking URL resolution and local logging/persistence, while also claiming mandatory downstream scoring and monitoring that are not actually enforced by the skill itself. This mismatch can mislead operators and users about what data is collected, where it is sent, and what safeguards or workflow steps are guaranteed, creating both security and privacy risk.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/search_searchapi.py (reported line 103)May include surrounding context.

python

def get_api_key():
    key = os.environ.get("SEARCHAPI_KEY")
    if not key:
        print(json.dumps({"error": "SEARCHAPI_KEY not set in environment. Add it to your .env file."}))
        sys.exit(1)
    return key

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill invokes network access, reads an API key from the environment, and instructs use of scripts that can persist data, but it declares no explicit tool scope or allowed-tools boundary. That increases the blast radius if the skill is executed in a permissive agent runtime, because the agent may be allowed to use more capabilities than the user or platform expects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill mandates saving user identifiers, channel names, delivery targets, and flight search details for later notifications, but provides no consent flow, minimization guidance, or user-facing privacy notice. That creates a real risk of unnecessary collection and retention of personally identifiable information and travel metadata, which are sensitive in context.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The instructions explicitly tell the agent to persist user IDs and delivery addresses for future notifications, which creates a durable data-retention surface and raises the chance of leakage through logs, monitor storage, backups, or misuse by downstream components. In a travel context, stored route/date data can also reveal sensitive behavioral patterns about a user.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill goes beyond searching flight data and also resolves booking links by following Google click-tracker flows to produce final airline/OTA URLs. That expands the skill's capability from passive search into link derivation and outbound interaction with third-party booking endpoints, which increases the attack surface and can expose users or downstream agents to unreviewed destinations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

Search requests and full API responses are written to disk without warning, which can capture sensitive travel information and returned booking tokens. Because the logs include raw API responses, this may preserve more data than necessary and enable replay or misuse of tokens by anyone with filesystem access.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill persistently logs CLI arguments, normalized results, and full API call request/response data to disk, even though the described behavior is only flight search. These logs can retain travel itineraries, tokens, and potentially booking-related metadata, creating unnecessary data exposure and retention risk if the host or workspace is shared or later compromised.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.