Security audit
Tongtu China Travel
Security checks across malware telemetry and agentic risk
Overview
This travel skill is purpose-aligned and disclosed, with no scanner or artifact evidence of malicious behavior.
Install only if you are comfortable adding the external flyai CLI from npm and sending travel search details such as cities, dates, and preferences to that service. Treat visa, payment, transport, and booking guidance as travel assistance and verify critical details with official providers before purchasing or traveling.
SkillSpector
By NVIDIA
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.