Moltravel - The Travel Agent for AI Agents

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 3:32 AM UTC
• Version: 1.0.0

Overview

This is a disclosed travel-assistant skill that uses a remote MolTravel MCP service for travel lookups, with privacy caveats but no evidence of hidden, destructive, or deceptive behavior.

Install only if you are comfortable sending travel-related details, such as dates, routes, destination interests, passport/nationality context, and safety questions, to the MolTravel MCP service and downstream travel providers. Avoid sharing unnecessary sensitive personal details, and verify prices, visa rules, and advisories with official sources before acting.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README describes capabilities powered by the MolTravel MCP server but does not clearly warn that user travel queries may be transmitted to a third-party remote service. This creates a transparency and privacy risk because users may disclose sensitive information such as travel dates, locations, nationality, or safety concerns without realizing that data leaves the local environment.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The skill description and README indicate automatic activation for a very broad class of travel-related requests, which can cause the agent to invoke the plugin for ordinary queries without clear user awareness or tight scope boundaries. In a skill that connects to a remote MCP service, overbroad triggering increases the chance that user prompts, itinerary details, passport/nationality context, or other sensitive travel data are unnecessarily sent to an external endpoint.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Stating that the remote `https://mcp.molttravel.com/mcp` endpoint becomes automatically available with no manual setup normalizes external network access without warning about data sharing, consent, or trust boundaries. In the context of an auto-invoked travel skill, this makes silent transmission to a third-party service more likely and increases privacy exposure.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The trigger language is very broad and can cause the skill to activate for generic travel-related conversation, even when the user did not intend tool use or external travel lookup. Over-broad activation increases unnecessary MCP exposure, can lead to inappropriate data sharing with the remote service, and may crowd out more suitable skills or normal conversational handling.

Static analysis

No suspicious patterns detected.