Security audit

Travel Guide Generator

Security checks across malware telemetry and agentic risk

Overview

The skill is a coherent travel-guide generator, but it tells users to paste an API key into chat and have the AI persist it permanently, which warrants Review before installation.

Review this skill before installing. Its travel-guide generation and AMap lookups fit the stated purpose, but do not paste API keys into chat. If you use it, configure AMAP_KEY yourself through your shell, OS environment settings, or a secret manager, and prefer temporary/session-scoped credentials when possible.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 88% confidence
Finding: The skill documents capabilities that use network access and environment-variable handling, but it does not declare corresponding permissions. This creates a transparency and policy-enforcement gap: a host may invoke the skill without understanding that it will access external services or manipulate credential-bearing environment state.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The README directs users to give an API key to the AI and states the AI will permanently write it into system environment variables. That expands the skill from travel-guide generation into credential handling and local system configuration, creating unnecessary risk of secret exposure, unintended persistence, or unauthorized environment modification.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill first instructs users to paste an API key into chat so the AI can configure it, then later warns users not to put keys into chat. That contradiction creates a strong social-engineering path for credential disclosure and normalizes sending secrets through an unsafe conversational channel.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The documentation explicitly encourages users to paste an API key into chat for automatic permanent configuration, without clear disclosure of how the credential will be handled, stored, or protected. This is dangerous because conversational channels are a poor place to transmit secrets and may lead to logging, retention, or accidental reuse of the key.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly asks the user to provide an AMap API key in natural language and says the AI will persist it as a user environment variable. Handling sensitive credentials this way risks disclosure in chat logs, downstream telemetry, or accidental reuse, and persistent storage increases blast radius if the host is shared or compromised.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The auto-trigger condition is broad enough to activate on ordinary travel discussion rather than an explicit request to run the skill. In this skill's context, overbroad triggering matters because the skill can perform network lookups and may prompt for or operate on configuration-related data, increasing the chance of unintended tool use or data exposure.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The metadata describes very broad automatic-invocation triggers for generic travel-planning phrases, which can cause the skill to run in situations where the user did not explicitly request this specific tool. Over-broad triggering increases the chance of unintended data handling, unnecessary external API calls, or hijacking user intent from other more appropriate skills.

Ssd 3

Medium

Confidence: 98% confidence
Finding: This text tells users to provide a live API key directly to the AI, which normalizes unsafe secret-sharing behavior and may cause the credential to be exposed in prompts, logs, transcripts, or downstream tooling. The added claim of permanent persistence increases the potential blast radius beyond a one-time request.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Even the alternative setup path suggests telling the AI the API key in plain language, again encouraging disclosure of a secret through an unsafe interface. Repeating the pattern in multiple places makes accidental credential leakage more likely and reinforces insecure operational habits.

Ssd 3

High

Confidence: 98% confidence
Finding: The documentation creates a direct natural-language pathway for users to disclose a sensitive API key in chat. Credentials shared this way may be retained in logs, visible to operators, or inadvertently exposed to other components, and the instruction lowers users' defenses by framing disclosure as normal.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.