Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` - Complete documentation (this file)
Security audit
Travel Business Wellness Integrator
Security checks for vulnerabilities and agentic risk
Overview
This skill is a simple business-travel wellness planner that generates informational JSON and does not show hidden execution, network access, persistence, or credential handling.
Installers should treat this as informational wellness planning, not medical or employment advice. The main caveat is scope: it may activate for broad travel-wellness prompts, so users should verify health recommendations with appropriate professionals and official sources.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (8)
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The first example scenario is entirely in Chinese and presents the response in Chinese without any indication that language is optional or user-selectable. This can violate language/locale policy expectations because the skill appears to prescribe a specific language style for at least some interactions without documenting opt-in or choice.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger criteria are broad and include generic travel and wellness phrases, which can cause the skill to activate outside its intended niche. Overbroad activation increases the chance of prompt interception, unintended routing, or the skill influencing unrelated user requests with domain-specific guidance the user did not explicitly request.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example prompts are phrased broadly enough to overlap with ordinary travel-planning requests, making accidental invocation more likely across unrelated contexts. In agent ecosystems, this can create prompt-squatting behavior where a loosely scoped skill captures traffic intended for more appropriate skills.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest metadata declares
language: en, and later requirements state "English documentation primary" while the document also contains a Chinese usage scenario. This creates a natural-language policy concern because the skill appears to impose an English-default locale rather than explicitly offering language choice to users.- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The module documentation presents the skill as merely descriptive, which suggests static informational output. In practice, the handler inspects user input for destination, timeframe, budget, business, and routine cues and dynamically constructs recommendations and frameworks based on that analysis.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The manifest sets the skill language to "en" with no indication that users can opt into another language or that the skill is intentionally limited to English for a stated regional or compliance reason. This is a natural-language policy concern because it imposes a locale choice by default.
- Content