Security audit

Alaska Air

Security checks for vulnerabilities and agentic risk

Overview

This Alaska Airlines scraping skill does the advertised search work, but it also mandates automatic external delivery and uses unsafe shell/tmp-file patterns.

Install only if you are comfortable with flight-search details and booking links being sent through Telegram and potentially processed by external worker models. Prefer a version that returns results in the main conversation by default, asks before messaging a Telegram destination, validates airport/date inputs, and avoids executable code or predictable files in shared /tmp.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:61
Finding: Shell Command Injection Through Unvalidated Route and Date Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:61
Finding: Predictable Shared Temporary Files Permit Symlink and Race Attacks
Content: View full analysis
Remediation: View remediation

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:33
Finding: Mandatory External Delegation and Telegram Delivery Can Redirect Query Data
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The operational instructions and mandatory output format are written to require Chinese-language responses such as '抓取失敗，請稍後再試' and the specified Telegram template, but the file does not offer the user any language/locale choice. Under the policy, forcing a specific language without opt-in is a natural-language policy violation unless the locale restriction is explicitly justified.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill is presented as a scraper, but it additionally instructs spawned sub-agents to immediately send results via Telegram to a caller-provided chat ID. That expands behavior from data retrieval into external transmission, creating an unintended exfiltration path and bypassing the normal primary interaction channel.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill directs immediate sending of query results to Telegram without any privacy notice, consent flow, or warning that user-requested travel data will be shared with a third-party channel. Even if the data seems low sensitivity, routing it externally can disclose user interests, itineraries, or identifiers such as chat IDs unnecessarily.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The sub-agent template explicitly instructs workers to transmit scraped results to a caller-provided Telegram chat immediately, establishing a natural-language disclosure channel outside the main interaction. Because the destination is externally supplied and transmission happens automatically, the pattern is dangerous even when the payload is only flight-search data.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The mandatory output section requires immediate Telegram delivery after every query, which is broader than the stated scraping purpose and couples retrieval with external dissemination. This design increases the chance that user queries, travel interests, or derived booking links are forwarded outside the expected conversation context without adequate review.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The required output format mandates immediate Telegram delivery of gathered results, encouraging automatic forwarding of user-requested data and generated booking URLs to an external recipient. This creates a built-in exfiltration mechanism and reduces opportunities for the main agent or user to review what is being sent before disclosure occurs.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.