TixFlow

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:16 PM UTC
• Version: 0.2.0

Overview

TixFlow is a coherent event assistant, but it asks users to trust high-impact ticket, wallet, and calendar capabilities without enough consent, scope, or privacy detail.

Review this skill before installing. Treat purchase, wallet, calendar, maps, and waitlist features as sensitive: require explicit confirmation before any ticket purchase or calendar change, verify whether it is demo-only or connected to real services, and avoid adding API keys until the publisher documents data sharing, wallet handling, fees, reversibility, and retention.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence

Finding

The skill metadata and documentation promise KYD Labs and Google Calendar integrations plus ticket purchasing, but the file itself indicates some features are only demo/mock and the analysis notes declared integrations are not actually implemented. This kind of description-behavior mismatch can mislead users and agents into making trust decisions based on capabilities or safeguards that do not exist, especially for actions involving purchases and calendar access.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises wallet detection and real cNFT ticket minting, but does not warn users that wallet information may be privacy-sensitive or that blockchain ticket purchases can be irreversible and may incur real financial consequences. In an agent skill context, this omission is more dangerous because users may invoke functions through a conversational interface without realizing they are triggering wallet-related actions or on-chain purchases.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill advertises automatic ticket purchasing and Google Calendar synchronization without a clear warning that it can spend money or modify a user's calendar. In an agent setting, missing consent and safety language increases the risk of unintended purchases, unwanted event creation, or privacy-impacting actions being triggered too casually.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The trigger list contains several short, generic phrases such as 'buy ticket', 'add to calendar', and 'get directions' that can plausibly appear in normal conversation and unintentionally activate the skill. In this skill’s context, accidental invocation is more concerning because the manifest advertises sensitive downstream actions like ticket purchasing, wallet interaction, calendar sync, and route generation, which could expose private data or initiate account-affecting workflows without clear user intent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The manifest describes sensitive capabilities including Google Calendar synchronization, route calculation, cNFT ticket minting, wallet detection, and waitlist management, but it does not warn users about privacy implications, external data sharing, or account effects. In this context, the omission is significant because users may not realize that using these commands can disclose location, calendar metadata, wallet association, or trigger blockchain-related transactions and third-party API usage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill exposes a ticket purchase action that appears to complete a wallet-linked transaction and mint an NFT without any explicit confirmation, cost disclosure, or warning that the action may be irreversible. In an agent setting, this creates a real risk of unintended purchases or user confusion, especially because the operation concerns financial assets and blockchain transactions that may not be reversible.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The calendar sync action accepts a user email and implies sharing event data with Google Calendar, but there is no visible consent, privacy notice, or explanation of what information will be transmitted to the third party. In an agent workflow, silent transmission of personal data to external services can violate user expectations and lead to privacy and compliance issues.

Content

No source excerpt is available for this finding.

Scope Creep

Low

• Category: Excessive Agency
• Confidence: 70% confidence

Finding

Skill's behavior or capabilities extend beyond its stated purpose. Scope creep allows an agent to perform actions unrelated to its documented functionality, increasing the attack surface.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md

- 🎫 **Smart Booking** - Purchase tickets across platforms
- 📅 **Calendar Sync** - Sync events to Google Calendar with reminders
- ⏰ **Waitlist Management** - Get notified when sold-out events have availability
- 🤖 **AI Agent Power** - Let your agent handle everything automatically

## Installation

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 90% confidence

Finding

The dependency is specified with a caret range (^120.0.0), which allows installation of newer minor and patch releases that may differ from what was tested. This weakens build reproducibility and can unintentionally pull in a vulnerable or breaking version from the supply chain.

Content

Scanner excerpt · package.json (reported line 21)May include surrounding context.

json

"author": "TixFlow Team",
  "license": "MIT",
  "dependencies": {
    "googleapis": "^120.0.0"
  }
}

Unverifiable Dependency: googleapis has 1 known advisory(ies) (GHSA-7543-mr7h-6v86 (Improper Authorization in googleapis)), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 82% confidence

Finding

The manifest includes googleapis without an exact pinned version, while the package has at least one known advisory affecting some releases. Because the allowed version range is not fixed, it is not possible to verify from this file alone whether installations will avoid the vulnerable versions, creating uncertainty and potential exposure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The waitlist feature collects a wallet identifier and notification preferences without a visible disclosure about storage, external sharing, or messaging implications. While lower impact than payment execution, it still introduces privacy and user-consent risk because wallet addresses can be sensitive identifiers and notification routing may involve third-party platforms.

Content

No source excerpt is available for this finding.