签证时间线

• Outcome: Review
• Latest audit: May 27, 2026 · 10:52 PM UTC
• Version: 1.0.2

Overview

This visa-planning skill is mostly aligned with travel document planning, but it asks agents to globally install external software, suggests sudo and a TLS-security bypass, and reads persistent travel profile data.

Review before installing. Do not run the sudo install or TLS-disable workaround, prefer a pinned and user-local FlyAI CLI if you choose to use it, and check or limit any saved travel profile data before letting the skill read or update it.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (18)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill’s stated purpose is visa timeline planning, but it also instructs use of flight and hotel search to generate preorder documents. That expands the skill into adjacent transactional/travel-booking behavior and can pressure users into disclosing more travel data or relying on potentially inappropriate supporting documents not strictly necessary for timeline planning. In this context, the mismatch increases unnecessary data exposure and capability creep.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill reads and stores persistent user profile data at startup even though a visa timeline helper can usually gather the few needed inputs interactively. Automatic access to memory or local profile files without clear necessity violates data-minimization principles and creates privacy risk if sensitive travel history, identity traits, or personal preferences are reused unexpectedly.

Description-Behavior Mismatch

Medium

• Confidence: 91% confidence
• Finding: The referenced documentation describes a generic travel AI search capability for hotels, attractions, flights, and trains rather than a visa-timeline-specific function. In a visa planning skill, this mismatch can cause the agent to invoke or rely on an overly broad search tool, leading to irrelevant results, incorrect workflow selection, or user confusion when handling time-sensitive visa planning requests.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The workflow requires a global CLI installation and shell execution before performing a simple visa-planning task, which expands the skill's privileges and attack surface beyond its stated purpose. Asking users or agents to install and run external tooling can modify the host environment, introduce supply-chain risk, and create opportunities for unintended command execution.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The instruction to set NODE_TLS_REJECT_UNAUTHORIZED=0 disables TLS certificate validation, allowing man-in-the-middle interception or tampering of supposedly secure requests. In a skill handling travel guidance, this can expose query contents and return manipulated results while normal security protections are bypassed.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The workflow extends into flight and hotel search even though the skill is described as a visa timeline assistant, creating unnecessary scope expansion and additional data/tool usage. While not inherently malicious, this broadening increases exposure to external services and can prompt collection or handling of travel details unrelated to the minimum required function.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The example dialogue expands the skill’s apparent capabilities from visa timeline planning into searching flights and hotels, which is outside the stated manifest scope. This can mislead downstream agents or users into invoking unapproved actions, increasing the risk of scope creep, incorrect delegation, or unintended access to travel-booking related tools or data.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The file documents a hotel-search capability even though the skill is presented as a visa timeline assistant. This kind of scope mismatch is dangerous because it can hide undeclared functionality, enable unintended tool use, and increase the chance that the agent accesses or acts on travel-booking data outside the user's expected consent and the skill's declared purpose.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: Hotel discovery, lodging filters, and booking-adjacent parameters are not context-appropriate for a visa-planning assistant, so their presence suggests capability creep or a repurposed reference that was not properly isolated. In an agent setting, irrelevant capabilities can be invoked accidentally or abused to steer the assistant into collecting extra travel preferences or performing actions beyond the user's visa-related request.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The reference file documents a Marriott hotel search tool even though the skill is described as a visa timeline and reminder assistant. This kind of capability mismatch can cause the agent to invoke or expose unrelated travel-search functionality, leading to scope confusion, unintended data handling, and increased attack surface through hidden or misbound tools.

Context-Inappropriate Capability

High

• Confidence: 96% confidence
• Finding: Hotel search and booking-adjacent functionality is context-inappropriate for a visa planning assistant, making it more likely that the agent could be induced to perform actions outside its intended trust boundary. In this context, the mismatch is especially risky because users seeking visa advice may unknowingly trigger unrelated travel workflows, exposing itinerary or location preferences and undermining least-privilege design.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The tool documentation grants access to flight, hotel, attraction, and restaurant search features that are unrelated to a visa timeline and document-reminder assistant. This expands the skill’s operational scope beyond user expectations, increasing the chance of unnecessary data access, misleading behavior, or misuse of broader travel-booking capabilities under a narrow visa-planning use case.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: This document introduces broad cross-skill persistence of user travel profiles, including storage and retrieval of personal preferences, which exceeds the stated purpose of a visa timeline/reminder assistant. That scope expansion creates unnecessary data collection and retention risk, especially because the persistence mechanism is designed for reuse across flyai-* skills rather than being limited to the current task.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The skill instructs writing personal data to Qoder Memory or local files without demonstrating that this is necessary for generating a visa timeline. Persisting user profile data beyond the immediate interaction increases privacy exposure and creates a secondary store of personal information that may be accessed by other skills or local processes.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill states that it reads historical user preferences on startup but does not clearly notify the user before this privacy-affecting behavior occurs. Silent retrieval of memory or local profile content is dangerous because users may not expect sensitive personal data to be accessed simply by invoking a visa helper, especially in a travel context involving passport and identity-related planning.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document instructs users to perform a global installation or upgrade, and even suggests sudo, without clearly warning that this changes the system environment and elevates privileges. This can lead to accidental system-wide modifications, unsafe execution habits, and increased impact if the package or command path is compromised.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: Recommending disabled TLS verification as a normal troubleshooting step is unsafe because it removes authenticity guarantees for network traffic. Without strong warnings or safer alternatives, users may permanently adopt insecure practices that expose them to interception and tampered responses.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The local file format stores detailed user profile information such as home city, airport, budget, family composition, travel history, and special needs, but the document provides no privacy warning, retention limit, deletion procedure, or access control guidance. This can lead to silent long-term storage of sensitive personal data on disk where other local users, tools, or backups may expose it.

Static analysis

No suspicious patterns detected.