Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - `SKILL.md` - Complete documentation (this file)
Security audit
Travel Slow Experience Architect
Security checks for vulnerabilities and agentic risk
Overview
This is a low-impact slow-travel planning skill with a simple local JSON handler and no evidence of hidden access, persistence, network use, or destructive behavior.
This skill appears safe to install for descriptive travel planning. Users should still verify travel details such as prices, safety advisories, visas, weather, and availability with official or current sources, and maintainers should tighten the broad trigger wording to avoid accidental activation.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (7)
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 70% confidence
- Finding
Without declared permissions the skill's intent is opaque and cannot be validated.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger guidance is broad enough to activate on common travel-planning phrases such as 'experience,' 'pace,' or generic requests for planning help. Overbroad activation can cause unintended routing, prompt hijacking of unrelated requests, or suppression of more appropriate skills, which is a security/control-plane issue even in a non-code skill.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example prompts use generic formulations like 'help me with ... for my trip' and broad travel-planning language that could match many normal itineraries. In systems that rely on examples for routing or prompting, this can cause accidental invocation and cross-skill interference, reducing reliability and potentially exposing users to irrelevant or lower-priority instructions.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example scenario is presented entirely in Chinese and explicitly says the assistant outputs a Chinese-language plan, but the README does not state that language selection is optional or user-driven. This can conflict with language/locale policy expectations when a skill appears to impose a specific language without opt-in.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
The manifest declares 'language: en', and the acceptance criteria later require 'English documentation primary', yet the file includes a full Chinese scenario. This can imply an English-first locale policy without explicitly stating that users may choose their preferred language.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest explicitly sets the skill language to "en", which can be read as enforcing a specific language/locale. Under the policy, locale constraints should either offer user choice or be clearly justified as region-specific, and no such justification appears here.
- Content
Static analysis
No suspicious patterns detected.