Security audit

smart-travel-planner

Security checks for vulnerabilities and agentic risk

Overview

The travel planner mostly does travel planning, but it also adds automatic local memory and self-modifying behavior without clear user control.

Review this before installing if you do not want the skill to keep a local history of usage, notes, errors, or preferences, or to evolve its own SKILL.md instructions over time. The travel features are ordinary, but the automatic memory and self-editing behavior should be removed or made explicit, opt-in, scoped, and deletable before broad use.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The skill is presented as a travel planner, but it also includes a generic persistence and self-learning subsystem that records usage history, failures, notes, and preferences. This creates undisclosed secondary behavior beyond the stated travel-planning purpose, increasing privacy and trust risks and enabling collection of user data unrelated to the core function.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The documented self-evolution system stores user preferences and usage history in a local file without a travel-specific justification. Persistent memory of free-form notes, errors, and preferences can accumulate sensitive natural-language data and be reused in later interactions outside the user's expectations.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill expands from travel assistance into persistent self-learning and even instructs writing experience back into SKILL.md. Automatic modification of skill content creates an integrity risk: prompts or behavior can drift over time without review, potentially introducing unsafe instructions or hidden behavior.

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The file describes and implements a generic cross-skill learning module that records usage history, error notes, and user preferences to a per-skill JSON file. For a travel-planning skill, this expands behavior beyond the declared purpose and creates unnecessary local telemetry storage that could capture sensitive personal data such as travel preferences, notes, or other user-specific information.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The implementation provides skill-agnostic telemetry and preference tracking, including arbitrary keys and values plus free-form notes, with no schema restrictions or privacy controls. In the context of a travel planner, this can accumulate personal profiling data unrelated to core itinerary generation, increasing privacy risk and creating a covert persistence channel inside the skill directory.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill describes automatic storage of preferences and usage history but does not provide a clear user-facing warning or consent flow. Silent persistence is dangerous because travel interactions may include personal preferences, destinations, budgets, and other sensitive details that users may not expect to be retained.

Natural-Language Policy Violations

Low

Confidence: 88% confidence
Finding: Automatically storing and reusing a language preference seems low-risk, but it still constitutes persistent personalization without explicit user consent. In aggregate with other retained fields, it normalizes silent profile building and weakens user control over stored preferences.

Ssd 3

Medium

Confidence: 95% confidence
Finding: Persisting user preferences, usage history, errors, and notes in a local memory file creates a straightforward data retention and leakage risk. Free-form fields such as notes and error text can capture sensitive personal or contextual information, which may later be exposed to other tools, users, or future prompts.

Static analysis

No suspicious patterns detected.