Security audit

Personal Travel

Security checks for vulnerabilities and agentic risk

Overview

This travel assistant is coherent, but it stores sensitive travel-document and itinerary details in a persistent workspace file without clear confirmation, minimization, or deletion controls.

Install only if you are comfortable with the assistant keeping travel history, passport expiration, visa, insurance, and budget details in a workspace file. Before use, prefer adding a confirmation step for every memory update, avoid storing document numbers or full policy details, and make sure users can review, correct, and delete the saved travel file.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:9
Finding: Plaintext Persistence of Sensitive Travel-Document Metadata<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-12`, `SKILL.md:18-21`, `SKILL.md:23-30`, `SKILL.md:45-46`, and `README.md:32-34` **Vulnerability Type**: Plaintext storage of sensitive information **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:9-12`: ```markdown ## Перед ответом 1. **Прочитай** `knowledge/personal/travel.md` — там прошлые поездки, вишлист, документы. 2. **Учитывай историю чата**. 3. Если пользователь рассказал **новое** (планирует поездку, вернулся, обновил документы) — обнови `knowledge/personal/travel.md`. ``` `SKILL.md:18-21`: ```markdown - **Документы:** паспорт (срок действия), визы (какие есть, сроки), страховки. - **Бюджет:** примерный бюджет поездки, трекинг расходов в поездке. - **Чеклист:** что взять с собой, что не забыть перед отъездом. - **Напоминания:** паспорт истекает через N месяцев, виза заканчивается. ``` `SKILL.md:23-30`: ```markdown ## Правила - Актуальные цены и визовые правила — проверять в интернете, не выдумывать. - Формат в `knowledge/personal/travel.md`: ```markdown ## Документы - Паспорт: действителен до YYYY-MM-DD - Визы: ... ``` `SKILL.md:45-46`: ```markdown ## Файлы - **Память:** `knowledge/personal/travel.md` — читать в начале, обновлять. ``` `README.md:32-34`: ```markdown ## Данные Хранятся в `knowledge/personal/travel.md` в воркспейсе агента. ``` ### Technical Analysis The Skill explicitly directs the Agent to persist passport expiration dates, visa information, insurance details, budgets, and travel history in `knowledge/personal/travel.md`. This is an ordinary Markdown file in the Agent workspace. No encryption, access-control requirements, restrictive file permissions, retention period, deletion workflow, consent prompt, or data-minimization policy is specified. The file must also be read at the beginning of relevant interactions, increasing how frequently sensitive information is exposed to the Agent context. Although the documented format does not request pa ...[truncated 1707 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Make persistent document tracking explicitly opt-in and explain which fields will be stored. 2. Require confirmation immediately before every write involving passport, visa, or insurance information. 3. Apply data minimization: - Store only reminder dates where possible. - Prohibit storage of passport numbers, visa identifiers, document images, authentication data, and full insurance policy numbers. - Avoid retaining exact travel dates unless necessary. 4. Store sensitive information in an access-controlled secret or personal-data store rather than a general Markdown workspace file. 5. If file storage is unavoidable, require restrictive filesystem permissions and encryption at rest. 6. Define a retention period and automatically remove expired document and itinerary information. 7. Provide commands for users to inspect, correct, export, and permanently delete stored information. 8. Prevent unrelated Skills and tools from reading the travel-memory file through workspace-level access controls. 9. Redact sensitive fields before including memory content in prompts, logs, diagnostics, or external requests. ]]>

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:9
Finding: Unverified Conversation Data Is Automatically Written to Persistent Agent Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9-12` and `SKILL.md:45-46` **Vulnerability Type**: Persistent memory poisoning through unverified chat content **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:9-12`: ```markdown ## Перед ответом 1. **Прочитай** `knowledge/personal/travel.md` — там прошлые поездки, вишлист, документы. 2. **Учитывай историю чата**. 3. Если пользователь рассказал **новое** (планирует поездку, вернулся, обновил документы) — обнови `knowledge/personal/travel.md`. ``` `SKILL.md:45-46`: ```markdown ## Файлы - **Память:** `knowledge/personal/travel.md` — читать в начале, обновлять. ``` ### Technical Analysis The Skill instructs the Agent to treat new conversational statements as grounds for updating persistent memory. It does not require explicit confirmation, validate structured values, record provenance, distinguish tentative statements from confirmed facts, or restrict the content that may be written. As a result, mistaken, hypothetical, ambiguous, or attacker-influenced statements may become durable state. Because the same file is read before future answers, poisoned records can influence subsequent itineraries, budget calculations, document-expiration reminders, and travel recommendations. The issue is limited to memory content under the behavior shown in the audited files. No mechanism for shell execution, privilege escalation, or arbitrary code execution was identified. ### Attack Path 1. An attacker or unauthorized participant gains the ability to send messages in a conversation where the Skill is active. 2. The attacker makes a false statement that appears to be new travel information, such as claiming that a passport expires on a different date, a visa has expired, or a destination has been confirmed. 3. Following the Skill instructions, the Agent writes the unverified statement to `knowledge/personal/travel.md`. 4. In a later session, the Agent reads the poisoned memory before responding ...[truncated 1131 chars]
Remediation: <![CDATA[ ## Remediation Suggestions 1. Require explicit user confirmation before every persistent-memory update. 2. Present the exact proposed change and distinguish additions, modifications, and deletions. 3. Use a strict structured schema with field validation: - Validate dates using an unambiguous ISO format. - Restrict document status to predefined values. - Reject instructions, markup, and unrelated free-form content in structured fields. 4. Distinguish confirmed facts from tentative plans, hypothetical statements, and quoted material. 5. Record provenance for every value, including creation time, source message, confirmation status, and last-modified time. 6. Maintain an append-only audit log and support rollback to earlier versions. 7. Never interpret text stored in memory as Agent instructions or executable directives. 8. Ask for reconfirmation before using stored document information for consequential travel advice. 9. Provide commands to display, correct, and delete all remembered travel information. 10. Restrict memory writes to authenticated conversations belonging to the affected user. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

High

Confidence: 97% confidence
Finding: The manifest description includes very broad trigger terms such as travel, trip, flight, hotel, visa, passport, country, city, and destination, which can cause the skill to activate in many ordinary conversations. Overbroad routing increases the chance that users disclose sensitive travel plans or document details to this skill unintentionally, expanding data collection beyond clear user intent.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: The README is written entirely in Russian, including the command phrases the user must use to invoke the skill. This imposes a specific language/locale on users without documenting that the skill is region-specific or offering an opt-in or alternative language choice.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The skill instructions and role definition are written entirely in Russian and specify a Russian-language tone without indicating that the assistant should adapt to the user's preferred language. This can violate language-choice policy because it implicitly constrains interaction to one language without opt-in or justification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the assistant to update a long-term memory file when the user shares new travel information, but it provides no user-facing notice or consent flow for storing sensitive data. Because the file is explicitly meant to hold passports, visas, insurance, and trip history, this can lead to silent persistence of highly sensitive personal information.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill explicitly directs persistence of sensitive personal travel data, including document validity, visas, insurance, destinations, dates, and spending, into a long-term knowledge file. Such aggregation creates a rich profile of the user's identity, movements, and credentials, which raises privacy risk and potential downstream harm if accessed, reused, or exposed improperly.

Static analysis

No suspicious patterns detected.