T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:147- Finding
Unmasked Passport and Raw MRZ Data Exposed in Conversation Output
- Content
View full analysis
- Remediation
View remediation
Security audit
southeast-asia-arrival-card
Security checks for vulnerabilities and agentic risk
Overview
This travel-form helper is related to its stated purpose, but it needs review because it handles full passport and travel documents and suggests automating official immigration submissions without enough privacy and user-control safeguards.
Review before installing. Use it only as a guide, verify requirements on official government sites, avoid uploading passport or booking images unless necessary, do not let an agent submit immigration or visa forms for you automatically, and manually review every declaration before submission.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (25)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill includes browser-automation pseudocode that visits government immigration sites, fills official forms with passport and travel data, submits them, and retrieves confirmation artifacts. In this context, that exceeds passive guidance and enables automated action on sensitive government workflows, creating risks of unauthorized submissions, mishandling of personal data, violation of site terms, and harmful errors in legal/immigration declarations.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The skill invites extraction of passport and travel details from uploaded documents, including MRZ-derived identity data, without a clear up-front privacy notice, consent gate, or data-handling warning. In this context, the danger is elevated because passports, flight records, and hotel bookings are highly sensitive and can enable identity theft, targeted phishing, or travel surveillance if over-collected or mishandled.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **[country-guides.md](reference/country-guides.md)** - 各国详细填写指南
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md - **[automation-framework.md](reference/automation-framework.md)** - 自动化脚本设计
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The trigger phrases are broad enough to match generic travel or visa-help requests, not just this skill’s intended niche. In a skill that requests passport and itinerary data and even suggests automation, overly broad invocation increases the chance of accidental activation, oversharing of sensitive personal information, and use outside approved scope.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill solicits highly sensitive identity and travel data, including passport number, date of birth, nationality, itinerary, email, and lodging details, without clear privacy, minimization, retention, or safe-handling guidance. In this context, that materially raises the risk of exposing personal data, enabling identity fraud, or normalizing unsafe disclosure of travel documents to an assistant.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The skill’s stated purpose is narrow travel guidance, but the content expands into broader visa/application automation and the metadata also references non-Southeast-Asian destinations. This scope drift is dangerous because it can cause the agent to invoke the skill in contexts where it should not operate, increasing the chance of collecting unnecessary sensitive data or providing inappropriate procedural/automation assistance for official government workflows.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The automation section encourages automated submission of official immigration forms but does not clearly warn about legal declarations, account risks, anti-bot restrictions, or consequences of incorrect filings. Because these are government systems and immigration submissions, omission of those warnings makes the content substantially more dangerous than ordinary web-form automation advice.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The documented flow includes handling email verification and saving confirmation materials, which moves the skill into account/access and credential-adjacent behavior rather than simple informational assistance. That is risky because it encourages the system to participate in authentication-linked processes and retention of sensitive travel artifacts tied to official submissions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The activation phrases are broad enough to trigger on common travel conversations such as 'visa application' or general country-entry questions. In a skill that requests passport and itinerary details, overbroad activation can cause unintended invocation, unnecessary collection of sensitive data, and user confusion about why this workflow is being engaged.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The skill is described as a Southeast Asia arrival-card helper, but these instructions explicitly expand it to arbitrary countries via live web search. That scope creep increases the chance of incorrect guidance, prompt-trigger abuse, and accidental handling of travel/immigration workflows outside the reviewed domain, especially because official requirements are time-sensitive and phishing-prone.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
These instructions add OCR-style extraction of passports, tickets, and hotel bookings, which materially expands the skill into sensitive identity-document processing beyond the manifest description. That creates unnecessary collection and normalization of highly sensitive PII and travel data, increasing privacy, compliance, and misuse risks if users are triggered to upload documents they did not expect to be processed this way.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The document provides automation guidance for submitting highly sensitive passport, identity, itinerary, and contact data to external government websites, but does not warn users about the privacy, legal, and account-security risks of automating such submissions. In this skill context, the omission is more dangerous because the workflow explicitly targets official immigration and visa systems, where mistakes, credential exposure, bot-detection issues, or unauthorized submission can cause denial of entry, account lockout, or leakage of personal data.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This markdown file presents all instructions, headings, and guidance exclusively in Chinese. Under the policy rule for natural-language violations, forcing a specific language without user opt-in or a documented regional justification is a reportable issue.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The guide hardcodes China-specific assumptions such as nationality, passport issuing country, phone prefix, and residence address format without user opt-in, despite the skill being described as a broader arrival-card assistant. This can mislead non-Chinese users into submitting incorrect immigration data or believing the workflow is universally applicable, which is risky in a regulated travel-compliance context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The document gives a concrete compliance claim that K-ETA is mandatory for Chinese citizens while elsewhere framing K-ETA as applicable to visa-waiver nationals, creating a misleading and potentially false immigration requirement. In a travel-document assistant, inaccurate entry guidance can cause users to pay unnecessary fees, rely on the wrong process, or face denied boarding/entry due to following incorrect instructions.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The entire guide is written in Simplified Chinese while specifically targeting Taiwan travelers, including references such as '台湾居住地英文地址'. This creates a locale/language mismatch and does not offer an alternative language option or explain why this language choice is required.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The document gives contradictory instructions about uploads: one section says a personal photo must be uploaded during profile setup, while later FAQ entries state no passport photo, files, or photos are required. In a travel-entry workflow, such inconsistency can mislead users into either disclosing unnecessary personal biometric data or failing to complete a required step, causing privacy exposure or travel disruption.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The document repeatedly states that all information 'must' be filled in English and treats use of Chinese as incorrect. Under the policy, forcing a specific language without user opt-in is a reportable natural-language violation unless the locale constraint is clearly documented and justified; here it is presented as a blanket rule without explaining that the official form itself requires that language.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation elsewhere repeatedly lists 8 prepared countries, but this section says to tell users the skill currently supports 6 Southeast Asian countries. This is an active contradiction in the skill's own instructions and can mislead users and downstream agents about the intended scope.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
This markdown file contains user-facing instructions only in Chinese, which can amount to a language-policy issue if the organization expects skills not to force a specific language without user opt-in. There is no indication that the content is intentionally limited to Chinese-speaking users or that an alternative language is available.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 82% confidence
- Finding
该指南在示例和指引中明确要求选择国籍为
CHINA并填写中国手机号+86，整体内容也默认面向中国用户，但未说明这是仅适用于中国旅客的特定版本或给出其他受众选择。按照规则，若技能在自然语言中强制特定语言/locale/地区前提而无明确选择或合理限定，可构成政策类问题。- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The instruction says to set the page language to "简体中文" for convenience, which imposes a specific language choice in the guidance rather than neutrally offering available options. This can conflict with language/locale choice policies when a skill should not force a locale unless clearly optional or justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The guide explicitly recommends switching the interface to Simplified Chinese by selecting "中国", which imposes a language choice rather than presenting it as an optional preference. Under the policy, forcing or recommending a specific language without offering a user choice can be a locale-policy issue unless clearly justified.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 87% confidence
- Finding
This markdown file contains user-facing instructions exclusively in Chinese, but it does not state that the skill is intended for a Chinese locale or offer an alternative language choice. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation.
- Content
Static analysis
No suspicious patterns detected.