Dubai

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 8:47 PM UTC
• Version: 1.0.0

Overview

This is a static Dubai advice skill with no executable behavior, but some neighborhood and legal guidance should be reviewed for bias and freshness.

This skill is safe to install from an agentic-security perspective, but treat it as general guidance rather than authoritative legal, visa, medical, housing, or safety advice. Verify current rules with official sources, especially because the content says it was last updated in February 2026, and do not rely on nationality-based neighborhood profiles when choosing where to live.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (30)

YARA rule 'php_webshell_known': Known PHP webshell families (c99, r57, b374k, WSO, etc.) [webshells]

Critical

• Category: YARA Match

Content

## Al Sufouh
✅ **Ideal for:**
- Young professionals in Media City
- Students / academics
- Beach lovers on a budget
- Those who want value

❌ **Avoid if:**
- You want "the address" prestige
- You need premium amenities
- You're looking for villa living
- You want a vibrant neighborhood scene

---

## 🏫 Schools

**Palm Jumeirah:**
- Limited — must drive to mainland schools
- Nearest: GEMS/WSO in Marina corridor

**Jumeirah 1-3:**
- **Jumeirah College** (IB)
- **Jumeirah English Speaking School** (British)
- **Jumeirah Baccalaureate School**
- **Dubai English Speaking School**
- Best school options of all beach areas

**Al Sufouh:**
- Limited
- Nearest: Schools in Al Barsha (10-15 min)
- Universities: AUD, AUS, Knowledge Village institutions

---

## 💡 Pro Tips

1. **Palm traffic:** If you work in DIFC/Downtown, add 45 min each way to commute
2. **Jumeirah villas:** Always do a thorough inspection — old properties have issues
3. **Al Sufouh:** Verify building age and qualit

• Confidence: 90% confidence
• Finding: YARA rule matched a known webshell pattern (PHP, Python, JSP, or ASPX webshell).

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The activation condition is extremely broad: 'User asks about Dubai for any purpose' can cause the skill to trigger on many loosely related queries. Over-broad invocation increases the chance of unintended routing, irrelevant guidance, and interference with other more appropriate skills, especially in multi-skill agent environments.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The resident profile uses nationality groupings as a descriptive and recommendation signal without clear necessity or user opt-in. In a housing or neighborhood guidance skill, this can steer users toward areas based on protected or sensitive characteristics, creating profiling and fairness risks even if the author likely intended to summarize demographics.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: This section continues to characterize neighborhoods by nationalities and diplomatic status, which can influence housing choices based on sensitive demographic attributes rather than objective factors. In relocation guidance, that creates a real risk of discriminatory steering or exclusionary personalization.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The Downtown resident profile assigns likely residents by nationality and ethnicity-like categories without a clear necessity for the skill’s travel or housing guidance purpose. This can normalize demographic profiling, embed bias into recommendations, and encourage users to make housing decisions based on protected or sensitive traits rather than neutral factors.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The DIFC section profiles residents using nationality labels tied to wealth and profession, which is not required to help users understand the neighborhood. In a housing and relocation context, this kind of demographic targeting is especially sensitive because it can reinforce discriminatory preferences and steer decisions in ways that may conflict with fair-housing expectations.

Natural-Language Policy Violations

Medium

• Confidence: 95% confidence
• Finding: The Business Bay profile segments residents by nationality mix even though the skill’s purpose is to advise on neighborhoods, costs, and lifestyle fit. In this context, the content can enable biased filtering or exclusionary inferences by users, making the issue more serious than a generic demographic statement in a purely statistical report.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The resident profile for Dubai Marina lists specific nationalities as characteristic residents, which can function as nationality-based steering in housing guidance. In a neighborhood-selection skill, this context makes the issue more sensitive because users may infer where people of certain nationalities 'belong,' reinforcing discriminatory preferences and potentially enabling biased housing decisions.

Natural-Language Policy Violations

Medium

• Confidence: 90% confidence
• Finding: The JBR section repeats nationality-based characterization of likely residents, again embedding protected-class cues into housing advice. Because the skill is explicitly guiding people on where to live, these descriptors can bias recommendations, normalize exclusionary reasoning, and create legal/compliance risk around discriminatory housing steering.

Natural-Language Policy Violations

Medium

• Confidence: 92% confidence
• Finding: The JLT resident profile categorizes residents by nationality, continuing a pattern of demographic steering across the file. In this skill's housing and relocation context, that makes the content more dangerous than a generic sociological description because it can directly influence user decisions about where to rent based on protected characteristics.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This housing guidance includes nationality-based resident profiling in a section meant to help users choose where to live. In a real-estate context, that can steer users toward or away from neighborhoods based on protected or sensitive demographic traits, reinforcing discriminatory housing preferences and creating fair-housing/compliance risk.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: This section again uses nationality-based framing to characterize likely residents of a neighborhood. In the context of relocation and housing advice, that can function as demographic steering by signaling social fit based on national origin rather than objective housing factors.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The Meadows profile identifies resident nationalities in a housing-selection guide, which is risky because it can influence user decisions based on protected demographic composition. Even if intended as descriptive market color, in this context it can support exclusionary or discriminatory decision-making.

Natural-Language Policy Violations

Medium

• Confidence: 98% confidence
• Finding: The DSO section describes the neighborhood using nationality-based demographic framing while advising users where to live. Because the skill is explicitly guiding housing and relocation choices, this increases the risk of discriminatory steering and potential legal or policy violations.

Natural-Language Policy Violations

Medium

• Confidence: 87% confidence
• Finding: Line L241 states "Passport \"X\" gender | Entry denied" as an absolute claim. This is a sensitive policy statement about gender marker treatment presented without nuance, sourcing at the point of claim, or indication that requirements may vary, which creates risk of embedding a restrictive organizational stance in natural-language guidance.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| DO | DON'T |
|----|-------|
| Be respectful and polite | Display public affection (kissing, hugging) |
| Ask permission for photos of people | Take photos of locals without consent |
| Use right hand for greetings/eating | Use left hand (considered unclean) |
| Keep voice down in public | Swear or use obscene language |
| Respect prayer times | Play loud music during prayer |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

| DO | DON'T |
|----|-------|
| Be respectful and polite | Display public affection (kissing, hugging) |
| Ask permission for photos of people | Take photos of locals without consent |
| Use right hand for greetings/eating | Use left hand (considered unclean) |
| Keep voice down in public | Swear or use obscene language |
| Respect prayer times | Play loud music during prayer |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

6. **Visiting outdoor attractions midday in summer** — dangerous heat
7. **Not having cash for souks** — many small vendors cash-only
8. **Forgetting to check medication rules** — some common meds are banned
9. **Taking photos of locals without asking** — rude and possibly illegal
10. **Disrespecting Ramadan** — eat/drink discreetly during fasting hours

---

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 87% confidence
• Finding: The guide includes alcohol prices and money-saving tips related to bars and drinks without noting Dubai’s legal, venue, and age-related restrictions. In a city guide aimed at visitors and residents with varying legal status, this omission could mislead users into assuming alcohol access and consumption are broadly unrestricted, creating legal/compliance risk rather than a direct cybersecurity risk.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The recommendation uses nationality labels as shorthand for cheap food options, which is unnecessarily broad and can read as culturally reductive. In a public-facing relocation guide, this can create reputational harm and reduce trust, especially when safer neutral phrasing could convey the same budget advice.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: Line L098 tells users to greet with "As-salamu alaykum," which nudges a specific language choice as expected behavior. Under the stated policy, forcing or strongly prescribing a specific language without opt-in can be a locale/language policy issue.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: Line L228 states "Females; males at Abu Dhabi campus" as a categorical rule. In a guidance document, this can read as a hard access restriction based on gender rather than contextual institutional information, which raises a natural-language policy concern around discriminatory or restrictive wording.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The line gives prescriptive natural-language guidance specifically for women, including 'Avoid revealing outfits,' which imposes a gendered norm rather than offering neutral or optional advice. This can be interpreted as a locale or policy-related style constraint without user choice or justification.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The phrase "English-speaking doctors" presents English-language access as a default feature, and later advice explicitly tells users to look for English-speaking doctors. Under the policy, language-related guidance can be a concern when it privileges a specific language without user opt-in or acknowledging alternatives.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This instruction explicitly directs users toward English-speaking doctors and does not frame language as a configurable preference. That can conflict with language/locale neutrality expectations because it steers users to one language rather than advising them to select providers based on their own language needs.

Static analysis

No suspicious patterns detected.