Security audit

Google Flights Search

Security checks across malware telemetry and agentic risk

Overview

The skill appears to be a flight-search tool, but the supplied evidence indicates it may automatically save travel searches and user delivery identifiers for monitoring without a clear consent boundary.

Install only if you want searches saved for recurring price monitoring. Before using it, verify that monitoring is optional, that you can delete saved searches, and that booking links are shown for your review rather than opened or followed automatically. I could not find the target artifact files in the provided workspace, so this verdict relies on the supplied scanner evidence and should be rechecked against the actual package contents before publication.

SkillSpector

By NVIDIA

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 87% confidence
Finding: The script’s stated role is flight search, but it also supports booking-token workflows and returns direct airline/OTA booking URLs. This expands the skill from informational search into transaction-enabling behavior, which increases phishing, unsafe redirection, and policy-bypass risk if downstream agents present or follow these links without validation.

Description-Behavior Mismatch

High

Confidence: 81% confidence
Finding: The metadata requires results to be routed through flight-scoring and persisted via flight-price-monitor, but this script directly returns raw results and only writes local logs. That mismatch can bypass intended safety and business controls, causing unreviewed results to be surfaced and expected monitoring/auditing behavior to be skipped.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The `_resolve_booking_url` helper posts opaque `post_data` to Google and extracts a redirect target from returned HTML, turning the skill into a redirect resolver. In an agent setting, this can expose users to unvetted external destinations and broadens the trust boundary beyond simple flight search.

Missing User Warnings

High

Confidence: 95% confidence
Finding: The skill repeatedly instructs the agent to ALWAYS save every search for ongoing price monitoring, but it does not require explicit user consent or even a clear notice before persisting travel preferences. This creates a privacy risk because travel dates, routes, and preferences are retained beyond the immediate request and may be linked to an identifiable user profile.

Missing User Warnings

High

Confidence: 98% confidence
Finding: These instructions direct the system to collect and store personal identifiers such as peer IDs, user names, channel names, and delivery addresses together with flight-search data, without any explicit privacy disclosure or minimization requirement. If mishandled, this enables unnecessary tracking, profiling, and disclosure of a user's travel interests and contact endpoints.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The workflow mandates persistent reuse of user and channel identifiers for recurring monitoring and notification beyond the current interaction. Even if intended for convenience, this expands the data lifecycle and attack surface by turning a one-time search into an ongoing tracked relationship without a clear consent boundary.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.