Weekend Scout

• Outcome: Pass
• Latest audit: May 28, 2026 · 1:58 AM UTC
• Version: 1.0.2

Overview

Weekend Scout is a disclosed event-discovery and Telegram-digest skill whose local storage, network use, and installer behavior fit its stated purpose.

Install only if you are comfortable with a Python package that stores your city, coordinates, event cache, logs, and optional Telegram bot token/chat ID locally, downloads GeoNames data, searches the web, and may send the generated digest to Telegram when configured. Use the reset/uninstall commands if you want to remove runtime state or installed skill files.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill declares broad operational behavior including shell execution, package installation, file access, and network use, but does not expose corresponding permissions or clear user-facing authorization boundaries. That makes the bootstrap step more dangerous because a user expecting an event-discovery workflow may unknowingly approve installation and runtime-modifying actions.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose is event discovery and digest delivery, but the skill also bootstraps runtimes, installs packages, manages multi-platform skill files, downloads datasets, and writes persistent local state. This mismatch is security-relevant because it hides materially more powerful behavior than users would reasonably infer, increasing the chance of unintended code execution, persistence, and data handling.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill can copy bundled files into global agent skill directories under the user's home directory, which modifies the broader agent environment beyond the narrow event-scouting purpose. While framed as installation convenience, this creates a persistence and supply-chain surface: a compromised package or unexpected bundled content could plant or overwrite agent-executed skills across platforms.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill description and usage guidance are broad enough that an agent could invoke it in many contexts without a clear, narrow trigger such as explicit user request, geographic scope confirmation, or consent to send results. Because this skill performs real-world discovery and can later transmit output externally, vague invocation criteria increase the chance of unintended execution and downstream actions the user did not specifically authorize.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The skill states that it will send the digest to Telegram, but the markdown does not present an explicit user-facing warning or consent checkpoint for external data transmission. In agent settings, outbound messaging is security-sensitive because it can exfiltrate user preferences, locations, or generated content to third-party services without sufficiently clear authorization.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The onboarding flow instructs the agent to write a setup JSON file under a cache path and persist it, but it does not require explicit user notice or confirmation before modifying local files. Even if the file contents are expected configuration, silent filesystem writes by an agent create a trust and consent issue and can be abused if path handling or surrounding runtime assumptions are compromised.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow persists precise home location data, including city, country, latitude, longitude, and travel radius, without requiring an explicit notice that this information will be stored or asking for informed consent at the point of persistence. This creates a privacy and data-handling risk because users may provide sensitive location information for immediate task completion without realizing it will be written to disk and retained for future runs.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The onboarding flow instructs the agent to write a setup JSON file and persist configuration to local storage without explicitly warning the user that local data will be modified. Even though the data appears limited to city, country, coordinates, radius, and language, this is still a persistent local side effect and may surprise users or bypass expectations about consent and transparency.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill states that it sends output to Telegram but does not present a clear user-facing warning that generated content and potentially location-related preferences or event selections will be transmitted to a third-party service. In a travel/events context, this can expose personal interests, city/location data, and schedule-related information outside the local environment.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states that it will send the generated digest to Telegram, but the user-facing description does not provide a clear warning that user-derived data such as location, preferences, or inferred travel intent may be transmitted to an external service. This creates a privacy and consent risk because users may invoke the skill without realizing that their data leaves the local/runtime environment and is shared with a third-party platform.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The setup wizard collects a Telegram bot token and chat ID, then persists them in plaintext YAML on disk without warning the user or applying any protection. If the local machine, repo checkout, backups, or home directory are exposed, the bot token can be stolen and abused to send messages as the bot or access bot-related data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly states it will send the generated digest to Telegram, but the documented workflow contains no clear user-consent or confirmation gate before message delivery. In an agent setting, that creates a real risk of unintended external communication, including disclosure of user preferences, location context, or generated content to a third-party channel without an explicit send approval at run time.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill advertises that it will send the compiled digest to Telegram, but the user-facing contract in this file does not clearly require explicit consent or a prominent notice before transmitting content to an external service. That creates a real privacy and data-handling risk, especially if results include user location, inferred travel preferences, or other context the user may not expect to leave the local agent environment.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The onboarding flow instructs the agent to write a setup JSON file and persist it to local configuration without an explicit user-facing notice that local state will be modified. In an agent setting, silently changing persisted configuration can violate user expectations and create consent and auditability problems, especially because the stored data includes location details.

Natural-Language Policy Violations

Medium

• Confidence: 80% confidence
• Finding: The instructions require setting search_language based on the resolved city match language, rather than the user's preferred language. This can silently alter downstream behavior and user-visible content in a way the user did not request, reducing transparency and potentially causing incorrect or inaccessible results.

Static analysis

No suspicious patterns detected.