Google Flights Search

• Outcome: Review
• Latest audit: Sep 11, 2026 · 3:22 AM UTC
• Version: 1.0.2

Overview

The skill performs flight searches, but it also automatically stores travel/contact data and raw flight API responses without clear user consent or retention controls.

Review carefully before installing. Use this only if users knowingly want automatic price monitoring, and require explicit consent before saving contact identifiers or travel plans. Audit the flight-price-monitor component, restrict or disable raw logs, redact booking/departure tokens, set retention/deletion rules, and use a limited SearchAPI.io key.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:244
• Finding: Mandatory Price Monitoring Exceeds the Minimum Privileges Required for Flight Search<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:244-261` **Vulnerability Type**: Mandatory collection and persistence of user identity, contact, and travel data **Risk Level**: Medium ### Vulnerable Instruction ```markdown ### Step 8: Save Price Monitor (MANDATORY) After presenting results, ALWAYS save the search for price monitoring. Build a compact snapshot from the top 10-15 flights as `"Airline|FlightNum|DepTime": price` pairs, then run: ```bash python3 {baseDir}/../flight-price-monitor/scripts/save_monitor.py \ --user-id "<peer_id>" \ --from <ORIGIN> --to <DESTINATION> --date <DATE> \ --return-date <RETURN_DATE> \ --currency <CURRENCY> --adults <ADULTS> \ --channel <channel> --delivery-to "<delivery_target>" \ --flights '<JSON snapshot>' ``` - `--user-id`: The peer ID from the session (e.g. `whatsapp:[phone]`). If unknown, use the user's name. - `--channel`: The channel the user is on (`whatsapp`, `telegram`, etc.) - `--delivery-to`: The user's address on that channel. Use `last` if unknown. - `--flights`: JSON object of `"Airline|FlightNum|HH:MM": price` pairs from the results. ``` ### Technical Analysis The declared primary function is to perform flight searches. Persistent price monitoring is a separate, stateful operation that is not technically necessary to return search results. The Skill repeatedly labels monitoring as `ALWAYS` and `MANDATORY`. It directs the Agent to collect and pass the following information to a sibling component: - Session peer ID or user name - Messaging channel - Delivery address - Origin and destination - Outbound and return dates - Passenger count - Flight and pricing snapshots This breaks least-privilege boundaries because a one-time search requires neither persistent storage nor the user's messaging address. The instructions do not require explicit user consent, provide an opt-out, define a retention period, or explain how the saved information will be protected. The invoked fi ...[truncated 1617 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace `ALWAYS` and `MANDATORY` monitoring with an explicit opt-in workflow. 2. Ask for informed consent before passing any information to the monitoring component. 3. Explain what data will be retained, why it is needed, how often checks run, and how the user can disable or delete the monitor. 4. Do not obtain a peer ID or delivery address unless the user affirmatively enables notifications. 5. Minimize stored information. Use a random monitor identifier instead of a messaging peer ID where possible. 6. Package and audit the monitoring implementation together with the Skill, or enforce a trusted-component allowlist. 7. Define retention limits and automatic deletion for stale monitors. 8. Require authenticated ownership checks before a monitor can be read, modified, or overwritten. 9. Provide separate commands for one-time search and optional monitoring so the search remains fully functional without persistent state. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/search_searchapi.py:344
• Finding: Raw Flight API Responses and Booking Tokens Are Persisted in Local Logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/search_searchapi.py:344-368` **Vulnerability Type**: Excessive logging of sensitive travel and booking data **Risk Level**: Medium ### Vulnerable Code ```python def save_log(args, api_calls, output): """Save request/response log for this search execution.""" try: LOG_DIR.mkdir(parents=True, exist_ok=True) timestamp = datetime.now().strftime("%Y%m%d_%H%M%S") filename = f"{timestamp}_{args.origin}_{args.destination}.json" log_entry = { "timestamp": datetime.now().isoformat(), "cli_args": { "origin": args.origin, "destination": args.destination, "date": args.date, "return_date": args.return_date, "days": args.days, "currency": args.currency, "adults": args.adults, "stops": args.stops, "travel_class": args.travel_class, }, "api_calls": api_calls, "normalized_output": output, } (LOG_DIR / filename).write_text( json.dumps(log_entry, ensure_ascii=False, indent=2), encoding="utf-8" ) except Exception: pass # Never let logging break the search ``` ### Technical Analysis Every execution calls `save_log`, which stores both the normalized result and the complete contents of `api_calls`. At the call sites, `api_calls` includes raw SearchAPI.io responses for standard searches, return-flight lookups, and booking lookups. Those responses can contain: - Opaque `departure_token` and `booking_token` values - Booking request URLs and POST data - Detailed routes and travel dates - Flight numbers, times, layovers, and prices - Passenger count, currency, travel class, and search preferences The code correctly excludes `api_key` from logged request parameters, but it does not redact sensitive fields returned in API responses. I ...[truncated 2004 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Disable detailed logging by default and require an explicit diagnostic flag to enable it. 2. Do not store complete API responses. Record only minimal operational metadata such as request duration, response status, and result count. 3. Recursively redact `booking_token`, `departure_token`, `post_data`, booking URLs, and any future token or credential fields before serialization. 4. Avoid logging full itinerary information unless it is strictly required for a documented operational purpose. 5. Create the log directory with mode `0700` and files with mode `0600`, independent of the process umask. 6. Remove route information from filenames and use random or opaque identifiers. 7. Implement automatic expiration, rotation, and secure deletion of logs. 8. Document the logging purpose and retention period and obtain consent if logs contain user-related travel data. 9. Ensure production logs and backups are encrypted and protected by access controls. 10. Replace the blanket exception handler with sanitized diagnostic reporting so logging failures can be investigated without exposing sensitive content. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented behavior expands beyond the declared purpose by including booking URL resolution and local logging/persistence, while also claiming mandatory downstream scoring and monitoring that are not actually enforced by the skill itself. This mismatch can mislead operators and users about what data is collected, where it is sent, and what safeguards or workflow steps are guaranteed, creating both security and privacy risk.

Credential Access

High

• Category: Privilege Escalation

Content

def get_api_key():
    key = os.environ.get("SEARCHAPI_KEY")
    if not key:
        print(json.dumps({"error": "SEARCHAPI_KEY not set in environment. Add it to your .env file."}))
        sys.exit(1)
    return key

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes network access, reads an API key from the environment, and instructs use of scripts that can persist data, but it declares no explicit tool scope or allowed-tools boundary. That increases the blast radius if the skill is executed in a permissive agent runtime, because the agent may be allowed to use more capabilities than the user or platform expects.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill mandates saving user identifiers, channel names, delivery targets, and flight search details for later notifications, but provides no consent flow, minimization guidance, or user-facing privacy notice. That creates a real risk of unnecessary collection and retention of personally identifiable information and travel metadata, which are sensitive in context.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The instructions explicitly tell the agent to persist user IDs and delivery addresses for future notifications, which creates a durable data-retention surface and raises the chance of leakage through logs, monitor storage, backups, or misuse by downstream components. In a travel context, stored route/date data can also reveal sensitive behavioral patterns about a user.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The skill goes beyond searching flight data and also resolves booking links by following Google click-tracker flows to produce final airline/OTA URLs. That expands the skill's capability from passive search into link derivation and outbound interaction with third-party booking endpoints, which increases the attack surface and can expose users or downstream agents to unreviewed destinations.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: Search requests and full API responses are written to disk without warning, which can capture sensitive travel information and returned booking tokens. Because the logs include raw API responses, this may preserve more data than necessary and enable replay or misuse of tokens by anyone with filesystem access.

Description-Behavior Mismatch

Low

• Confidence: 96% confidence
• Finding: The skill persistently logs CLI arguments, normalized results, and full API call request/response data to disk, even though the described behavior is only flight search. These logs can retain travel itineraries, tokens, and potentially booking-related metadata, creating unnecessary data exposure and retention risk if the host or workspace is shared or later compromised.

Static analysis

No suspicious patterns detected.