Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is useful and non-executable, but it asks the agent to persist sensitive travel details and cross-session activation preferences without enough disclosure or scoping.
Install only if you are comfortable with a travel assistant keeping local markdown records of trips and preferences. Before use, set it to activate only when asked, avoid storing passport numbers, insurance policy numbers, medical details, payment details, or full booking confirmations, and periodically review or delete ~/travel-planning/ plus any MAIN memory entry it creates.
### 1. First: Integration (within first 2-3 exchanges)
Figure out when this skill should activate in the future:
- "Should I jump in whenever you mention a destination or trip idea?"
- "Want me to help proactively — like reminding you about booking windows — or only when you ask?"
- "Any upcoming trips I should start tracking?"
Save their answer to their MAIN memory so other sessions know when to use this skill.
Technical Analysis
The skill instructs the agent to copy user-provided answers into shared, persistent “MAIN memory.” These answers are free-form natural-language input rather than constrained configuration values. Consequently, an attacker can embed instructions or behavioral rules in an answer and cause them to be retained beyond the current skill invocation.
This operation also conflicts with the declared scope in SKILL.md:219-228, which states that the skill manages data only under ~/travel-planning/ and does not read files outside that directory. Shared agent memory is outside the documented skill-local storage boundary.
The vulnerable pattern is persistent storage of unsanitized, attacker-controlled instructions in a state source that may be consumed by unrelated future sessions. The issue does not grant operating-system privileges, but it can improperly influence subsequent agent decisions and skill activation.
Attack Path
An attacker invokes the travel-planning skill or participates in its onboarding process.
When asked how the skill should activate, the attacker supplies an answer containing additional behavioral instructions, such as directing future sessions to ignore normal activation boundaries or to perform unrelated actions.
Following setup.md, the agent stores the complete free-form answ
...[truncated 876 chars]
Remediation
View remediation
Remediation Suggestions
Remove the instruction to save free-form user responses in MAIN memory.
Store activation preferences only in ~/travel-planning/memory.md, preserving the skill's documented storage boundary.
Represent the preference using a strict allowlisted field, for example:
markdown
activation: proactive
where the only accepted values are proactive, on_request, and disabled.
Never persist arbitrary user text as instructions, policies, or activation rules.
If integration with shared memory is essential, obtain explicit consent and write only a sanitized, application-generated summary rather than the user's original text.
Treat all persistent-memory content as untrusted data when it is loaded. It must not override system instructions, safety constraints, or current-session goals.
Add namespace and provenance metadata so that any stored setting is clearly owned by the travel-planning skill and can be deleted independently.
T09 · Insecure Skill Coding Practices
Warning
Location
SKILL.md:112
Finding
Plaintext Storage of Sensitive Travel, Medical, Identity, and Booking Data
Content
View full analysis
Vulnerability Details
File Location: SKILL.md:112-125; supporting instructions in memory-template.md:20-25, setup.md:50-56, and booking-guide.md:82-89 Vulnerability Type: Insecure plaintext storage of sensitive personal data Risk Level: Medium
Vulnerable Code
Primary vulnerable instructions from SKILL.md:112-125:
markdown
### 6. Family & Group Travel
When traveling with kids or groups:
- Create travelers.md in trip folder with each person's details (dietary, medical, seat prefs)
- Plan kid-friendly activities with energy breaks
- Book accommodations with kitchen access (saves 30%+ on food)
- Check child visa/consent requirements (some countries need notarized letters)
- Pack shared items list to avoid duplication
- Assign roles: navigator, budget tracker, activity planner
### 7. Document Safety (with user consent)
Only store document info if user explicitly shares it:
- Passport expiry dates (for validity warnings)
- Visa requirements per destination
- Travel insurance policy numbers
- Emergency contacts (embassy, bank, family)
- Never store full document images — only reference numbers
Supporting storage template from memory-template.md:20-25:
markdown
## Documents (only if user shares explicitly)
<!-- Ask before storing sensitive info: "Want me to track your passport expiry?" -->
passport_expiry: YYYY-MM-DD
frequent_flyer: [programs]
travel_insurance: [provider]
Supporting booking instructions from booking-guide.md:82-89:
markdown
Save immediately in `bookings.md`:
- Confirmation numbers
- Dates and times
- Addresses
- Contact numbers
- Cancellation policies
- Payment method used
Technical Analysis
The skill directs the agent to store identity metadata, medical and dietary information, insurance details, emergency contacts, frequent-flyer information, booking confirmation numbers, and payment-method m
...[truncated 2745 chars]
Remediation
View remediation
Remediation Suggestions
Apply data minimization and store only information strictly required for a specific planning function.
Require explicit, informed consent before storing every category of sensitive data, including medical details, emergency contacts, insurance data, booking references, and loyalty information.
Avoid storing full insurance policy numbers, booking confirmation numbers, passport numbers, card numbers, security codes, or authentication credentials.
Clarify that “payment method used” permits only a non-sensitive label such as personal credit card and must never include a card number, expiration date, security code, bank account, or billing credential.
Redact sensitive identifiers when a reference is necessary, retaining only a minimal suffix or user-defined alias.
Create data files with owner-only permissions and verify that the containing directory is not readable by other users.
Recommend an encrypted credential manager or encrypted document store when a sensitive reference must be retained.
Establish retention and deletion rules. Remove booking and medical metadata after the trip unless the user explicitly requests continued storage.
Warn users before placing the directory in cloud synchronization, source control, shared backups, or archives.
Add a documented command or workflow allowing users to review, export, redact, and securely delete all stored travel information.
The hidden comment instructs the agent to infer travel style 'naturally' rather than ask directly, encouraging covert preference profiling without transparent user awareness. While not overtly malicious, this undermines informed consent by collecting behavioral data implicitly and storing derived personal attributes in memory.
Content
Scanner excerpt · memory-template.md (reported line 15)May include surrounding context.
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
Content
Scanner excerpt · memory-template.md (reported line 19)May include surrounding context.
md
<!-- Examples: spontaneous, detailed planner, budget-conscious, luxury, solo, couple, family -->
## Preferences
<!-- Accommodation type, pace, food preferences, activity level -->
## Documents (only if user shares explicitly)
<!-- Ask before storing sensitive info: "Want me to track your passport expiry?" -->
Missing User Warnings
High
Category
Not specified by scanner
Confidence
97% confidence
Finding
The skill encourages storing document-related travel information such as passport expiry and frequent flyer data in persistent markdown memory without explicit caution, minimization, or consent. Travel document details are sensitive and can aid identity fraud, account takeover, or targeted social engineering if exposed or reused beyond the immediate planning task.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding
The skill's activation guidance is very broad, covering nearly the full travel lifecycle and general travel-related tasks. This can cause the agent to invoke the skill in loosely related conversations, increasing the chance of unnecessary file access, over-collection of personal travel data, or actions the user did not clearly request.
Content
No source excerpt is available for this finding.
Autonomous Decision Making
Medium
Category
Excessive Agency
Confidence
75% confidence
Finding
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
Content
Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.
md
- Over-scheduling → leave discovery room (max 3 planned activities/day)
- Forgetting to document after trip → memories fade in days, not months
- Booking without checking visa requirements → some need 90+ days
- Ignoring passport validity → many countries require 6 months beyond trip dates
- Not saving confirmation numbers → create bookings.md immediately
- One-night stays in cities → exhausting, skip or extend
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The template directs creation of persistent local files containing travel preferences, trip schedules, and potentially sensitive document metadata, but it does not require a clear user-facing disclosure that this information will be retained on disk. Users may share passport-related or itinerary details without understanding that the agent is building a lasting profile, creating privacy and data-retention risk.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The instruction to update the last field on every interaction implies continuous retention and ongoing profiling, yet there is no corresponding requirement to notify the user that each conversation may refresh or extend stored memory. In a travel-planning context, repeated updates can accumulate behavioral patterns and future travel plans over time, increasing privacy exposure.
Content
No source excerpt is available for this finding.
Vague Triggers
Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding
The activation logic is framed broadly enough to trigger whenever the user mentions destinations or trip ideas, which can cause the skill to engage and collect data in many ordinary conversations not clearly intended for travel planning. Over-broad triggers increase the risk of unsolicited profiling, persistence, or context capture beyond the user's expectations.
Content
No source excerpt is available for this finding.
Context-Inappropriate Capability
Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding
The skill explicitly instructs saving activation preferences to a shared MAIN memory across sessions and skills, which exceeds what is necessary for travel-planning alone. Cross-skill persistence increases the chance that preference data is reused in unrelated contexts without clear user understanding or consent, creating an avoidable privacy and scope-expansion risk.
Content
No source excerpt is available for this finding.
Missing User Warnings
Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding
The setup directs the agent to save personal travel preferences and activation behavior to persistent memory without an explicit privacy warning at the point of collection. Even if the data seems routine, silent persistence across conversations can undermine user expectations and expose behavioral profiling information unnecessarily.
