rpg-travel: Game Pilgrimage · RPG 旅行：游戏圣地巡礼

• Outcome: Pass
• Latest audit: May 29, 2026 at 8:34 PM UTC
• Version:
  1.0.6

Overview

This skill coherently creates game-themed travel itineraries, but it uses FlyAI/Fliggy travel searches and saves itinerary files that may contain personal trip details.

Install only if you are comfortable using FlyAI/Fliggy for travel searches. Configure FlyAI credentials through the official CLI, not in chat. Review generated HTML/TXT files before sharing them, and remember that opening the HTML can contact third-party image hosts and store check-in progress in the browser.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger section includes broad natural-language phrases like 'Travel following games' and 'Game location pilgrimage' that could activate the skill from ordinary conversation rather than an explicit opt-in. In an agent environment, this can cause unintended invocation, leading to unnecessary web searches, use of FlyAI-backed travel queries, and generation of outputs that may expose user intent or consume external-service quotas.

Vague Triggers

High

• Confidence: 91% confidence
• Finding: The activation rule allows the skill to trigger on extremely broad inputs such as merely entering a game name or generic travel intent. Overbroad triggers are risky because they can cause the agent to invoke this skill unexpectedly in unrelated conversations, leading to unnecessary collection of travel details, network lookups, or file generation without clear user intent. In a skill that asks for departure city and builds commercial travel outputs, accidental activation increases privacy and trust risks.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The listed trigger phrases are generic natural-language requests that overlap with ordinary chat about games or travel. This broad matching can cause unintended routing into a skill that performs external searches and creates purchase-oriented itineraries, which is more invasive than a simple informational reply. Because the skill is designed to gather user travel preferences and generate outbound links, false activations can expose users to unnecessary data handling and commercial nudging.

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The skill is configured to trigger on a bare game title, which is a very broad pattern that can easily collide with ordinary conversation. In this skill, activation can lead to follow-up collection of travel details and use of external services, so an accidental trigger may cause unintended data gathering or workflow execution without clear user intent.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The descriptive trigger phrases are broad, conversational expressions that may appear in normal discussion about games or travel inspiration. Because the skill can pivot into itinerary building and third-party searches, these ambiguous triggers increase the chance of unintended invocation and processing of user travel-related data.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill explicitly requires FlyAI CLI credentials and instructs the agent to query real flight, hotel, and attraction data using user-supplied trip details, but it does not clearly notify the user that these details will be sent to an external service. Departure city, destination, and inferred dates are personal travel-planning data, and transmitting them without clear disclosure and consent creates a privacy and data-sharing risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill writes itinerary and map files to local storage but does not warn the user in advance that files will be created. These files may contain personal travel preferences, destinations, dates, and booking links, so silent persistence can surprise users and increase privacy or data-retention risk on shared systems.

VirusTotal

66/66 vendors flagged this skill as clean.