Travel

• Outcome: Review
• Latest audit: Jul 27, 2026 · 10:16 AM UTC
• Version: 1.0.2

Overview

The skill is a coherent local travel archive, but it can automatically read, write, and delete sensitive local records across shared travel, booking, health, contact, pet, vehicle, and finance files without asking first.

Review this skill before installing if you do not want an agent maintaining a long-term travel archive automatically. It is not trying to exfiltrate data and it says credentials should be stripped, but it can update and delete local records in shared folders; keep backups and consider instructing the agent to preview file changes before saving them.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The skill instructs the agent to write recurring card annual fees into a shared finances file outside the travel skill's own data area. That creates a scope-boundary violation and risks cross-domain persistence of sensitive financial metadata without clear user consent, increasing the chance of oversharing or contaminating unrelated personal records.

Vague Triggers

Medium

• Confidence: 89% confidence
• Finding: The skill's trigger scope is very broad and includes common conversational travel mentions, increasing the chance it activates in situations where the user did not intend persistent travel-record handling. In this skill's context, unintended invocation matters because it is designed to read and write sensitive local records across multiple folders, so over-triggering can expose or modify personal data unnecessarily.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill reads and writes sensitive travel, identity, booking, health, pet, vehicle, and finance-adjacent data across several local paths, but the user-facing description does not prominently warn that these records may be accessed and updated. This reduces informed consent and can lead users to disclose or trigger processing of sensitive personal information without realizing the breadth of file access.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill directs the agent to store third-party personal contact data in a shared persistent file using identifiers such as email or handle, but gives no privacy, consent, minimization, or retention guidance. In this travel context, that can cause unnecessary collection and long-term storage of personal data about guides, drivers, hosts, or friends-of-friends who may not expect to be recorded across trips and accessed by other skills.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The skill instructs broad persistent writes in the same turn to multiple shared files containing sensitive travel, group, pet, accessibility, and contact information, without an explicit warning that stored records will be modified or a confirmation checkpoint. This increases the risk of silent cross-file data persistence, accidental overwrites, and accumulation of sensitive personal data beyond what the user intended for a single travel interaction.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to delete a wishlist entry and perform several writes across multiple files in one turn, but it does not require confirmation, preview, or rollback safeguards before destructive changes. In a memory/archive skill, this creates a real risk of unintended data loss, corruption of historical records, or incorrect bulk updates if the trip, place, or archetype is misidentified.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to create and update local files under artifacts and ~/Clawic/data/bookings without any user confirmation or warning that persistent state will be modified. In an agent setting, silent writes can cause unintended data tampering, privacy issues, and incorrect record changes, especially during a stressful disruption workflow where the user may have asked only for advice rather than authorization to edit records.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The write policy is triggered by extremely common travel events and encourages persistent writes for many routine mentions, which can cause unintended state changes from casual conversation. In an agent setting, broad persistence rules increase the risk of storing inaccurate, premature, or unnecessary user data without clear confirmation boundaries.

Vague Triggers

High

• Confidence: 98% confidence
• Finding: The phrase 'No permission needed' removes an important safety boundary around file writes and authorizes the agent to persist data without explicit approval. In practice, this can lead to silent writes, privacy issues, and corruption of durable records from inferred or misunderstood user statements.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The instruction mandates persisting spend figures, refunds, and claims to files, but gives no warning that these records may contain sensitive financial and dispute data. In a personal agent context, automatic long-term storage of such data can expose card-related habits, claim history, travel movements, and other private details if the filesystem is later accessed by other skills or parties.

Missing User Warnings

Low

• Confidence: 91% confidence
• Finding: The skill explicitly instructs writing travel-related facts into a persistent local file path under the user's home directory without any warning, confirmation step, or clear disclosure that local records will be modified. Even though the content is operational rather than overtly malicious, silent persistence can create privacy, integrity, and surprise-modification risks, especially if the agent performs writes automatically.

Missing User Warnings

Low

• Confidence: 96% confidence
• Finding: This instruction chains several post-trip writes in one step across multiple local knowledge files, increasing the chance of unintended persistence, overcollection, and modification of user-maintained records without granular approval. In a travel skill, these records may include sensitive movement history, vehicle identifiers, and place-specific notes, so the multi-file nature makes the behavior more dangerous than a single isolated write.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The skill explicitly instructs the agent to persist operational travel details into long-lived artifact files, including airport/city notes and border-crossing presence records, without any guardrails on minimization, consent, sensitivity, or retention. In a travel context, these records can reveal location history, future movement patterns, and other personal itinerary data, creating privacy and security risk if stored unnecessarily or exposed to other tools, users, or sessions.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

- The traveller is not a solo adult: children, a group splitting money, elderly parents, a pet, or a stay long enough to have legal consequences
- Coming home: what was actually spent, what to recommend, what to never pack again, what to claim
- Not for one trip's day-by-day itinerary (`travel-planning`), fare search (`flight`), accommodation search (`booking`), car hire (`car-rental`) or emigrating (`expat`) — this is the layer that outlives any single trip
- Mode: **act-as** the system of record (write the archive without asking) and **advise** on decisions. Never execute a transaction.

## Quick Reference

• Confidence: 92% confidence
• Finding: without asking

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.