Tenerife

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 10:49 PM UTC
• Version: 1.0.0

Overview

This is a static Tenerife travel and relocation guide with no executable behavior, though some legal, medical, and safety advice should be verified before acting.

Use this as a general Tenerife guide, not as professional advice. Before acting on visa, tax, healthcare, medication, parking, driving, hiking, or marine-activity guidance, verify current rules with official sources or qualified local professionals.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The phrase "User asks about Tenerife for any purpose" is extremely broad and lacks boundaries for when this skill should or should not activate. It does not provide exclusion conditions or negative examples, so ordinary conversation about Tenerife could unintentionally invoke the skill.

YARA rule 'network_reconnaissance': Network reconnaissance and scanning patterns [hacktools]

Medium

• Category: YARA Match

Content

ntains (Teide, Vilaflor)

**Character**: Alpine at peak, pine forest zone below

| Altitude | Summer | Winter |
|----------|--------|--------|
| 1,000m | 20-25°C | 10-15°C |
| 2,000m | 15-20°C | 5-10°C |
| 3,000m+ | 10-15°C | -5 to 5°C |

**What to expect**:
- Snow on Teide summit (Dec-Mar)
- Pine forests from 1,000-2,000m
- Very sunny above cloud line
- Cold nights, warm days
- Wind can be fierce

### East Coast (El Médano, Granadilla)

**Character**: Sunny but windy

- Similar temps to south coast
- Wind almost constant
- Great for water sports
- Less humid than rest of island

---

## Monthly Guide

### January-February
- **South**: Perfect, 20-23°C, sunny
- **North**: Pleasant, occasional showers, 18-20°C
- **Mountains**: Cold, possible snow on Teide
- **Best for**: Escaping northern European winter, hiking

### March-April
- **South**: Warming, very dry, 22-25°C
- **North**: Clearing, wildflowers, 20-22°C
- **Mountains**: Snow melting, great hiking
- **Best for**: Hikin

• Confidence: 65% confidence
• Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The line 'Double parking tolerated briefly (hazards on)' normalizes an unsafe and potentially unlawful practice without any warning that it can obstruct traffic, block emergency access, or create collision risk. In a travel/driving guidance skill, users may reasonably treat this as actionable local advice, so omission of a clear safety and legality warning makes the guidance dangerous.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The section implies certain medications, including 'basic antibiotics,' may be obtainable without prescription but does not warn readers that availability depends on current Spanish law, pharmacist assessment, and the specific medicine. In a healthcare guidance skill, users may act on this information directly, which could encourage inappropriate self-medication, delayed medical care, or unlawful/unsafe attempts to obtain antibiotics.

Natural-Language Policy Violations

Low

• Confidence: 79% confidence
• Finding: Line L065 says 'Learn basics at minimum,' which is a normative instruction favoring a specific language. Under the policy, forcing a language without user opt-in can be a natural-language locale violation, and this document does not explicitly frame the recommendation as optional or context-dependent.

Natural-Language Policy Violations

Low

• Confidence: 78% confidence
• Finding: The guidance says 'Recommend public/local schools' in the context of language adaptation, which favors Spanish-language immersion as a default recommendation. Because the document does not explicitly present this as an optional preference or ask the user to choose their language/locale priorities first, it can be read as a locale preference baked into the skill guidance.

Natural-Language Policy Violations

Low

• Confidence: 70% confidence
• Finding: The language row states 'Spanish' for public healthcare while contrasting private care as 'Often English', and the rest of the document assumes Spanish-language interaction terms without explicitly offering language-choice guidance. This can amount to a locale/language policy concern because it normalizes a single language context rather than giving users an explicit choice or accommodation path.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: Line L021 frames lack of Spanish as a barrier, and later lines reinforce Spanish learning as an expectation for integration. Under the policy for natural-language violations, this can be read as imposing a language preference without explicit user opt-in or a clearly documented locale-specific requirement.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: Line L308 says 'Learn Spanish seriously,' which is a direct language directive. Because the document does not present this as an optional preference or provide alternatives, it may conflict with the language/locale policy described in SQP-3.

Missing User Warnings

Low

• Confidence: 94% confidence
• Finding: The file recommends multiple inherently risky outdoor activities such as hard hikes, summit attempts, remote gorge routes, and cycling climbs, but it does not explicitly warn about serious injury, dehydration, falls, altitude effects, rescue delays, or emergency preparedness. In a travel guidance skill, users may rely on the advice as practical planning guidance, so omitting clear hazard framing can encourage underprepared participation in activities where mistakes can lead to hospitalization or stranded hikers.

Missing User Warnings

Low

• Confidence: 95% confidence
• Finding: The water sports section promotes surfing, kitesurfing, diving, kayaking, snorkeling, and whale watching without clearly warning about currents, surf conditions, wind strength, reefs, boat traffic, supervision, or drowning risk. Because this skill is aimed at visitors and non-locals who may not understand Tenerife's local sea conditions, the omission increases the chance that inexperienced users treat the recommendations as safe by default.

Natural-Language Policy Violations

Low

• Confidence: 77% confidence
• Finding: This is a natural-language locale statement in a markdown file that can be read as prescribing a specific language requirement. The policy allows language constraints when clearly justified or optional, but this line does not frame it as advice or offer alternatives.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: The guide states 'Spanish language instruction' as a fixed characteristic of public schools without any user-choice framing or opt-in around language/locale expectations. Under the policy rule for language or locale constraints, this is a mild natural-language issue because the content presents a mandatory language environment rather than offering alternatives or clearly framing it as contextual information.

Vague Triggers

Low

• Confidence: 77% confidence
• Finding: The 'Getting Help' section broadly suggests finding tax/admin help via nomad communities, coworking recommendations, and online services, but provides no explicit boundaries on when this guidance should be invoked versus when formal professional advice is required. In a markdown skill context, this kind of open-ended assistance framing can act as an overly broad trigger without negative examples or narrower scope constraints.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: Line L237 says to avoid establishments with "we speak English" signs. This is a natural-language recommendation that disfavors English-language accommodation without offering a user choice or explaining a policy-based reason, which can conflict with language/locale neutrality expectations.

Static analysis

No suspicious patterns detected.