Voyage

• Outcome: Review
• Latest audit: Sep 23, 2026 · 3:29 AM UTC
• Version: 2.3.1

Overview

This travel skill is useful in scope, but it includes automatic silent self-updates, cron persistence, environment changes, account authorization, and cross-skill data sharing that need careful review before installation.

Install only if you are comfortable with a travel skill that can store sensitive itinerary and reservation details locally, configure external booking/search services, initiate account authorization, share confirmed trip briefs with another local skill, and update its own files from GitHub on a schedule. Before use, disable or review voyage.update and cron registration, require explicit approval for package installs, OAuth, MCP additions, and any real booking or payment-related action.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (41)

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

The skill can pull and apply updates from a remote GitHub source, which is self-modifying behavior. Silent remote updates create a supply-chain risk: a compromised repository, dependency, or transport path could alter the skill's logic, permissions, or exfiltration behavior without meaningful review by the operator.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

text

## Self-update

`voyage.update` pulls the latest package from the `source:` URL in frontmatter. Runs silently — no output unless the version changed or an error occurred. See `references/self-update.md` for the full 7-step procedure.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 97% confidence

Finding

This line reiterates that voyage.update silently pulls the latest package from the configured source. Silent self-modification is particularly dangerous in a travel skill that already has network access and handles sensitive itinerary/reservation data, because post-update behavior could change without user awareness.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

md

## Self-update

`voyage.update` pulls the latest package from the `source:` URL in frontmatter. Runs silently — no output unless the version changed or an error occurred. See `references/self-update.md` for the full 7-step procedure.


## Visibility

Self-Modification

High

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

The support-file map explicitly includes self-update instructions, confirming that self-modification is an intended operational capability rather than a stray mention. Any mechanism that can replace local skill code or references from remote content materially raises the chance of supply-chain compromise or unexpected capability drift.

Content

Scanner excerpt · SKILL.md (reported line 256)May include surrounding context.

md

| `references/storage-and-config.md` | When inspecting or configuring the on-disk data files and default config |
| `references/okrs.md` | When reviewing OKR definitions or scoring skill performance |
| `references/initialization.md` | On first use; Marriott MCP setup, flights library install, GoPlaces check |
| `references/self-update.md` | When running voyage.update; full 7-step update procedure |
| `references/vesper-intake-delivery.md` | After a trip is confirmed; write the brief to Vesper's intake directory |
| `references/plans/trip-planning.plan.md` | Before a multi-step trip-planning request; destination research → itinerary → accommodation bundling |
| `scripts/hotelsbyday_search.py` | Bundled HotelsByDay harness for day-use rooms,and night stays; call via venv Python for quick searches |

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

The skill states it self-updates every 24 hours via voyage.update, making self-modification automatic and recurring. Automatic periodic updates maximize exposure to repository compromise or malicious upstream changes and reduce the window for human review before new code begins handling user travel data.

Content

Scanner excerpt · SKILL.md (reported line 264)May include surrounding context.

Update command

This skill self-updates every 24 hours via:

bash

voyage.update

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The initialization procedure includes multiple system-changing operations—filesystem writes, config creation, package-related setup, and scheduler registration—without a clear warning or consent boundary. That violates safe skill behavior because a user invoking a travel feature would not reasonably expect privileged persistence and environment modification as a side effect.

Content

No source excerpt is available for this finding.

Self-Modification

High

• Category: Rogue Agent
• Confidence: 98% confidence

Finding

A documented self-update mechanism is a form of self-modification, and here it is implemented by downloading a tarball and replacing local files in place. In the context of a travel-planning skill, self-modification is not necessary for core functionality and materially increases the attack surface by enabling unreviewed post-deployment changes.

Content

Scanner excerpt · references/self-update.md (reported line 1)May include surrounding context.

md

# Self-Update Procedure

`voyage.update` pulls the latest package from the `source:` URL in frontmatter. Runs silently — no output unless the version changed or an error occurred.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The file describes silent self-updating and local file replacement, but the skill metadata describes only travel-planning functions and does not disclose this operational capability. Hidden update behavior is dangerous because it undermines user trust and reviewability, and can be used to introduce new behavior after installation without clear notice.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The documented voyage.update flow fetches code from a remote repository and recursively copies extracted contents over the local skill directory, giving the skill self-replacement capability unrelated to travel planning. This creates a supply-chain and arbitrary code/content replacement risk: if the source repo, branch, or fetched content is compromised, the local skill can be silently altered without meaningful verification or user review.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The changelog explicitly documents direct delivery of travel briefs into another skill's intake directory, creating undeclared cross-skill filesystem interaction. Even though this is only a changelog entry, it signals behavior that can bypass normal typed journal interfaces and expands the skill's effective data-sharing scope beyond travel planning into inter-agent data placement, which raises confidentiality and integrity concerns.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Reservation management plus persistent journaling in a travel-planning skill implies handling sensitive personal itinerary data, possibly including names, dates, destinations, companions, and booking details. Without a clear user-facing warning about storage, updates, and persistence, users may unknowingly expose private travel patterns and related metadata.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The README advertises restaurant and activity recommendation capabilities that are outside the declared skill scope in the provided metadata. This creates a scope/intent mismatch that can mislead users and orchestrators into invoking behavior they did not consent to or expect, increasing the chance of unauthorized data use or unsafe tool routing.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Advertising journaling and self-updating behavior without corresponding manifest visibility is dangerous because both features materially change the trust model: journaling implies persistence of potentially sensitive travel data, and self-updating can alter runtime behavior after review. Hidden persistence and code/update pathways reduce auditability and can enable unreviewed changes or unexpected retention of user information.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill clearly performs networked actions across multiple external providers, but the manifest does not declare an explicit tool scope such as allowed network/tool permissions. That weakens the platform's ability to constrain execution and makes it easier for the skill to access unintended external services if behavior expands or referenced files/scripts are modified.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger phrases are broad enough that the skill may activate on common travel-related requests without clear user intent for reservation-oriented processing. In this skill's context, accidental activation matters because it can initiate network searches, persist trip data, and involve other skills/services handling sensitive travel details.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The frontmatter description explicitly excludes visa advice and similar compliance-oriented travel guidance, but the 'When to Use' section says the skill should be used for 'Travel document and requirement checking.' That is a semantic mismatch in stated scope because document/requirement checking overlaps the excluded visa/customs/compliance domain.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The condition 'When any skill needs travel-related data' is overly broad and can cause this skill to be invoked as a general travel data fetcher across workflows. Because Voyage persists data and coordinates with multiple external providers and downstream skills, broad invocation expands unnecessary data exposure and unintended side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 99)May include surrounding context.

When the user needs flight options, Voyage uses the fli library to query Google Flights data directly. No API key or browser required.

LetsFG (booking-capable complement): For the broadest price scan (budget carriers, OTAs, stable repeat pricing) and actual booking without OTA checkout redirects — flights and free-cancellation pay-later hotels — use LetsFG (pip install letsfg, one-time letsfg auth card-on-file setup, nothing charged; NEVER use letsfg register/setup-payment, those create a paid Developer API billing account). Hotel bookings carry a 5% non-refundable reservation fee. Run fli first (no credentials); add LetsFG results when a token exists or the task involves booking. See references/letsfg.md.

For quick searches, use the bundled script:

bash

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill states that it persists plan state, recommendations, reservation details, and journals to local files, but the description does not give users a clear upfront warning about this storage. Travel itineraries, companions, reservations, and preferences are sensitive personal data, so undisclosed persistence creates privacy and retention risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The optional-skill-cooperation section says Voyage 'does not do raw web searches itself,' yet the rest of the file describes direct querying of Google Flights via the fli library and multiple web/provider searches such as Expedia web and HotelsByDay via a web harness. Those are direct external search operations, so the statement contradicts the documented behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill documents delivery of trip details into another skill's intake directory, but this cross-skill sharing is not surfaced as a clear user-facing warning or consent step. Sharing confirmed travel details with another component increases the spread of sensitive itinerary data and can surprise users who believed data stayed within Voyage.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

Triggering initialization on first invocation of any Voyage command makes privileged setup actions easy to invoke through broad, routine usage. That increases the chance that file creation, config changes, and other side effects occur without the user understanding that system-level setup will be performed.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Registering a cron job creates scheduled background execution and persistence beyond the immediate user request. In a travel-planning skill, silent background tasks are not obviously necessary and could be abused for recurring network access, data processing, or continued execution after the original interaction ends.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The initialization instructions direct the agent to modify the runtime environment by globally installing an MCP server and initiating an external OAuth login flow. Those actions exceed ordinary in-skill travel planning and can introduce supply-chain, persistence, and account-authorization risk if performed automatically or without explicit user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The OAuth login step authorizes access to an external Marriott account but does not warn about privacy, session scope, or what data and actions the integration may gain. In a reservation-management skill, account linkage is sensitive because it can expose booking data and potentially enable reservation-related actions under the user's identity.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill instructs adding a third-party MCP server endpoint to platform configuration, which changes trusted execution boundaries and may expose the agent to remote capabilities outside the declared travel-planning scope. Even if the endpoint is legitimate, modifying MCP configuration is a privileged system action that can create new attack surface and data exposure paths.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.