Security audit
Security checks for vulnerabilities and agentic risk
The skill is a travel-award search helper whose API, alert, saved-trip, cash-price, and optional logged-in browser behavior are disclosed and aligned with that purpose.
Before installing, expect the skill to use travel itinerary data, award-alert state, transfer-partner or card context, external price lookup, and sometimes airline login sessions you provide. Use it only with accounts and profile data you are comfortable applying to award-search workflows, and confirm alert creation or logged-in airline actions before proceeding.
This is a markdown file, so vague-trigger review applies. The description explains what the skill does but does not specify concrete trigger phrases, activation boundaries, or exclusion conditions, which can make invocation criteria ambiguous in systems that rely on natural-language matching.
The skill handles potentially sensitive travel-profile data, including saved trips, alerts, and a user's credit card transfer-partner context, without an upfront privacy notice or explicit consent boundary. In an agent setting, this can normalize access to personal data and lead to overcollection, surprise processing, or disclosure of itinerary and financial-profile details beyond user expectations.
No suspicious patterns detected.
