T08 · Insecure Dependencies
Warning
- Location
INSTALLATION.md:30- Finding
Unpinned npm Package Execution with Access to a Gemini API Key
- Content
View full analysis
- Remediation
View remediation
Security audit
Navifare - Flight Price Double-Check, Finds Hidden Deals
Security checks for vulnerabilities and agentic risk
Overview
This skill’s behavior matches its flight-price-comparison purpose, but it sends itinerary details to Navifare and its optional local setup has normal npm/API-key supply-chain risks.
Install only if you are comfortable sending pre-booking flight itinerary details to Navifare for comparison. Avoid uploading screenshots that contain names, booking references, loyalty numbers, passport data, or payment details. If using the local npm option, pin the package version where possible and use a dedicated, low-quota Gemini API key. Treat returned booking links as third-party links and verify the destination domain before entering personal or payment information.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
SKILL.md:213- Finding
Remote Booking URLs Are Rendered as Trusted Links Without Validation
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
MCP Config Access
High
- Category
- Agent Snooping
- Confidence
- 95% confidence
- Finding
Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.
- Content
Claude Code / Claude Desktop
Add to
~/.claude/mcp.json:json {
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The installation guide directs users to a hosted MCP endpoint but does not clearly warn that flight details, screenshots, and travel metadata will be transmitted to a remote third-party service. Because this skill is specifically triggered by user-shared flight prices and screenshots, the omission can lead to unintentional disclosure of sensitive itinerary or personal travel information.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The note says the local installation needs a Gemini API key 'for the format tool's natural language parsing,' but this skill is described as finding hidden flight deals by comparing booking sites. That documentation introduces a different apparent intent centered on formatting/parsing rather than deal discovery, and it conflicts with the skill-specific purpose described in the manifest.
- Content
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # For Claude Code cp -r navifare-hidden-flight-deals ~/.claude/skills/ # Or clone from the repository git clone https://github.com/navifare/navifare-mcp.git
Skill Enumeration
Medium
- Category
- Agent Snooping
- Confidence
- 85% confidence
- Finding
Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
- Content
bash # For Claude Code cp -r navifare-hidden-flight-deals ~/.claude/skills/ # Or clone from the repository git clone https://github.com/navifare/navifare-mcp.git
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The skill claims it automatically activates whenever users mention flight prices from any booking site, but it does not specify when the agent should refrain from invoking it. That ambiguity increases the chance the agent will over-trigger on incidental travel discussions and send user-provided itinerary details to an external service when the user did not clearly request price checking.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The README defines automatic activation using broad natural-language cues such as 'Is this a good price?' and 'Should I book this?', which can be encountered in normal conversation outside the intended narrow context. In an agent environment, this can cause unintended invocation of the skill and transmission of itinerary or screenshot-derived travel data to a third-party MCP service without sufficiently explicit user intent at the moment of activation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill's activation criteria are broad enough to trigger on ordinary flight-related conversation such as mentioning a booking, comparing options, or asking if a fare is good. This can cause unintended tool use and unnecessary transmission of itinerary and pricing data to the Navifare MCP service, increasing privacy risk and reducing user control over when external services are contacted.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The screenshot-analysis flow encourages extracting travel itinerary details from uploaded images and comparing them across external booking sites, but the examples do not warn users about what data may be processed, retained, or sent to third parties. Even if the content claims 'no personal info,' screenshots can contain names, booking references, loyalty numbers, or other sensitive metadata, creating privacy and consent risks.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The example trigger phrases are very broad, common conversational language such as asking whether a flight price is good. In an agent ecosystem, this can cause unintended skill activation on benign travel discussions, leading to unnecessary collection or processing of itinerary details and external-search actions without sufficiently explicit user intent.
- Content
Missing User Warnings
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
The local installation instructions require a third-party Gemini API key but do not warn users about credential handling, key storage, or that submitted flight data may be processed by an external AI provider. This can cause users to embed sensitive credentials in config files and unknowingly route personal travel data to another external service.
- Content
Static analysis
No suspicious patterns detected.