Security audit

Travel Personality Test

Security checks for vulnerabilities and agentic risk

Overview

The skill is a travel quiz, but it can automatically install and call an unpinned external FlyAI integration for live recommendations without clear user consent.

Review this before installing. The main risk is not that the quiz content is malicious, but that using it may automatically install and run the FlyAI skill and send travel preferences, destinations, dates, or budget details to an external service. Install only if you trust the FlyAI dependency path, can approve external lookups, and are comfortable with the branded travel-output behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

Location: SKILL.md:237
Finding: Automatic Installation of an Unpinned Third-Party Skill
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Note

Location: SKILL.md:334
Finding: Forced Commercially Branded Output and Unverified Service Attribution
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

Context-Inappropriate Capability

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to run shell commands to check for and automatically install an external dependency, then export an API key and invoke it. Auto-installing tools from within skill logic is dangerous because it changes the execution environment, may introduce unreviewed code, and can expose secrets or system details during installation and troubleshooting.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The README advertises '实时推荐' and later states that the skill depends on flyai for hot destinations, flight prices, hotel prices, and trend analysis, but it does not clearly disclose at the point of use that user travel queries may be transmitted to an external service. This creates a privacy and consent risk because users may share destinations, dates, budgets, or other travel preferences without realizing that third-party processing is involved.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases include broad, common travel intents such as '推荐旅行目的地' and '适合去哪玩', which can cause this skill to activate during ordinary trip-planning conversations where the user did not explicitly ask for a personality test. Unintended activation can redirect the conversation, collect unnecessary preference data, and increase the chance that downstream external integrations are invoked without clear user intent.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The version note says the description was changed to Chinese, and the entire skill documentation and examples are presented only in Chinese with no indication that users may choose another language. This can violate language-choice policy when a skill implicitly forces a specific locale without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes broad everyday phrases such as '最近想出去玩' and generic destination requests, which can cause unintended activation in unrelated conversations. Overbroad triggering is risky because it may steer the agent into this skill's external-tool and planning behaviors without clear user intent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to automatically install/configure an external dependency and set an API key can disclose local environment characteristics, encourage unsafe secret handling, and create side effects outside the skill's core function. In this context, the skill is framed as a lightweight quiz, so hidden environment manipulation is especially unjustified and increases risk.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill materially expands from a low-risk personality quiz into travel planning, flight/hotel price lookup, and destination assistance. That scope expansion can trigger external data access, user expectation mismatches, and tool use beyond the principle of least privilege for the declared skill purpose.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This markdown file is entirely written in Chinese and all sample prompts/queries assume Chinese input such as "适合去哪玩" and persona labels in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language policy violation unless the locale restriction is explicitly documented and justified, which this file does not do.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrases include broad, common travel intents like '推荐旅行目的地', '适合去哪玩', and '最近想出去玩', which can match ordinary conversation unrelated to taking a personality test. This can cause unintended skill activation, leading the agent to enter quiz or recommendation behavior when the user did not explicitly request this skill, increasing the chance of context hijacking or inappropriate dependency use.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The template invites users to check flight/hotel prices through an external integration ('flyai') without telling them that travel details may be sent to a third party. Users may provide dates, destinations, budgets, or other personal travel preferences without informed consent, creating a privacy and transparency risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This section again offers flight/hotel price checks via an external integration without warning that user itinerary information could be shared outside the assistant. Even if the data is not highly sensitive, travel timing and destination data are personal and should not be forwarded without notice and consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill suggests using an external service to retrieve travel pricing but omits any privacy warning or consent step. That can mislead users into disclosing personal travel plans under the assumption the interaction remains fully within the assistant.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: In the '夜行者' template, the external flight/hotel lookup is presented as a helpful next step but still lacks any privacy or data-sharing notice. Because the skill encourages follow-on planning, users may naturally provide detailed itineraries that are sent externally without understanding the privacy implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This finding is valid because the template offers external flight/hotel pricing support without transparency about third-party data handling. Repeated undisclosed prompts across multiple persona outputs increase the chance that users share travel details without informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: Although this instance references only flight prices rather than hotel lookup, it still encourages use of an external service without warning about possible data transfer. Users may assume a private in-assistant recommendation flow when their travel interests or planned dates could instead be sent to another system.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documented rule says flyai can only be called after all 10 questions are completed and the result is calculated. Later, the example says '正在计算你的人格类型...（同时调用 flyai 查询实时推荐）', which contradicts the stated sequencing by implying the external call happens during calculation rather than after outputting the result.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.