Security audit

Japan

Security checks for vulnerabilities and agentic risk

Overview

This Japan travel skill is a disclosed local-memory trip planner with no executable code or network behavior, but it does store trip preferences on the user's machine.

Install this only if you are comfortable with the agent creating ~/japan/memory.md and retaining trip details locally. Avoid storing sensitive confirmation numbers on shared machines, and ask the agent to show, edit, or delete the memory file if you do not want old trip context reused.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The first-time setup trigger is broad enough that ordinary conversation about Japan travel could invoke setup behavior without clear user consent. Because setup creates local state and leads to persistent collection of travel preferences, accidental activation can cause unexpected storage of personal trip information.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to create ~/japan/memory.md and store user answers about travel timing, locations, preferences, and constraints, but it does not warn the user that persistent local storage will occur. This undermines informed consent and can expose sensitive personal data such as schedule, budget, mobility, or dietary constraints to anyone with local access.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The returning-user flow says to 'Read it silently' if the memory file exists, meaning previously stored personal travel information is accessed without notifying the user at that moment. Silent retrieval increases privacy risk because users may not realize past data is being reused, especially if it includes constraints or preferences they did not expect to persist.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The example trigger phrase 'I am going to Tokyo' is a very common natural statement and may unintentionally activate travel-planning flows that collect or persist user data. In this skill, that overlap is more concerning because the setup logic includes memory creation and later reuse of stored preferences.

Natural-Language Policy Violations

Low

Confidence: 77% confidence
Finding: The title and content define the skill as a Japan-only transport guide. Under the policy, locale-specific constraints can be a concern when a skill forces a specific region or locale without presenting it as an opt-in choice or clearly documenting the limitation as a justified regional tool.

Static analysis

No suspicious patterns detected.