Italy

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:40 AM UTC
• Version: 1.0.0

Overview

This is a coherent Italy travel guide skill with scoped local preference storage and no executable code or network behavior, though users should be aware it may create a local travel preferences file.

Install only if you are comfortable with the skill keeping a local file at ~/italy/preferences.md for travel personalization. Review or delete that file if you do not want dietary details, budget, visited places, trip history, or inferred preferences retained. The guide says its information is current as of early 2024-2025, so verify prices, hours, tickets, transport rules, and safety-sensitive plans before relying on them.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The 'When to Use' description says the skill applies when a user is 'planning a trip to Italy or wanting local insights,' which is a broad natural-language condition without explicit trigger boundaries or exclusions. This could overlap with ordinary travel conversation and makes it unclear when the skill should activate versus when general assistance would be more appropriate.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

## Top 3 Mistakes Tourists Make

1. **Cappuccino after 11:00** — Order espresso, you'll blend in
2. **Sitting down without checking price** — Standing €1, seated €3-4
3. **Skipping Oltrarno** — Best food and artisans, fewest tourists

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The template is designed to persist personal travel preferences and trip history across conversations, but it provides no user-facing notice, consent mechanism, retention guidance, or limits on what should be stored. This creates a privacy risk because it encourages ongoing collection of behavioral and preference data that could be sensitive when aggregated over time.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The 'Agent fills this in based on conversations' section explicitly directs the agent to infer and record user preferences from dialogue without notifying the user or asking permission. Inferred data can be especially privacy-sensitive because users may not realize that implicit signals from conversation are being turned into persistent profile attributes.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The setup instructs creation of a persistent preferences file in the user's home directory to store behavioral and potentially sensitive travel data such as food restrictions, budget, and visited places, but provides no notice about privacy, retention, access scope, or deletion. This creates a real privacy/security weakness because personal data may be stored longer than expected and exposed to other local tools, users, backups, or future prompts without informed consent.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|---------|---------|
| Kids are welcome everywhere | Even nice restaurants, late dinners |
| Late bedtimes normal | Italian kids up at 22:00 with parents |
| Servers love kids | Will likely bring treats without asking |
| Piazzas = playgrounds | Kids run around, parents have aperitivo |
| Nonnas will comment | Usually compliments, sometimes unsolicited advice |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

|---------|---------|
| Kids are welcome everywhere | Even nice restaurants, late dinners |
| Late bedtimes normal | Italian kids up at 22:00 with parents |
| Servers love kids | Will likely bring treats without asking |
| Piazzas = playgrounds | Kids run around, parents have aperitivo |
| Nonnas will comment | Usually compliments, sometimes unsolicited advice |

• Confidence: 75% confidence
• Finding: Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Natural-Language Policy Violations

Low

• Confidence: 76% confidence
• Finding: The guidance includes normative statements such as 'Cappuccino after 11am = tourist giveaway' and 'Alfredo pasta = doesn't exist in Italy,' which can steer responses toward a prescriptive local norm without offering user choice or framing it as optional cultural context. This risks forcing a locale-specific perspective rather than adapting to the user's preferences.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Line L106 states that everyone uses WhatsApp and instructs the user to download it if they do not have it. This is a natural-language recommendation that pushes a specific communication platform without opt-in or discussion of user preference, which can be read as forcing a tool choice.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: Lines L120-L122 state that users should not back away, should maintain eye contact, and should expect louder volume as if these norms uniformly apply. This can pressure users into adopting a specific interpersonal style without opt-in and may conflict with individual comfort, accessibility, or personal boundaries.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This markdown file includes a wine-trip itinerary and explicitly states that a car is essential for winery hopping, but it does not warn users about the safety implications of alcohol consumption combined with driving. For travel guidance that could affect user safety, a brief warning to plan tastings responsibly and avoid drinking and driving would improve disclosure.

Missing User Warnings

Low

• Confidence: 65% confidence
• Finding: The section is labeled family-friendly but includes a limoncello farm as a kid-friendly stop without any qualification. While likely intended as a sightseeing stop, the description would benefit from a brief warning or clarification to avoid implying child participation in alcohol-focused consumption.

Static analysis

No suspicious patterns detected.