Navifare - Flight Price Double-Check, Finds Hidden Deals

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 6:01 PM UTC
• Version: 1.1.0

Overview

This skill’s behavior matches its flight-price-comparison purpose, but it sends itinerary details to Navifare and its optional local setup has normal npm/API-key supply-chain risks.

Install only if you are comfortable sending pre-booking flight itinerary details to Navifare for comparison. Avoid uploading screenshots that contain names, booking references, loyalty numbers, passport data, or payment details. If using the local npm option, pin the package version where possible and use a dedicated, low-quota Gemini API key. Treat returned booking links as third-party links and verify the destination domain before entering personal or payment information.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: INSTALLATION.md:30
• Finding: Unpinned npm Package Execution with Access to a Gemini API Key<![CDATA[ ## Vulnerability Details **File Location**: `INSTALLATION.md`, lines 30-46 **Vulnerability Type**: Unpinned third-party package execution with credential exposure **Risk Level**: Medium ### Vulnerable Code ```markdown ### Local Installation (Alternative) If you prefer to run the MCP server locally via npm: ```json { "mcpServers": { "navifare-mcp": { "command": "npx", "args": ["-y", "navifare-mcp"], "env": { "GEMINI_API_KEY": "your-gemini-api-key" } } } } ``` **Note**: Local installation requires a [Google Gemini API key](https://ai.google.dev/) for the format tool's natural language parsing. The hosted service handles this automatically. ``` ### Technical Analysis The local installation executes `npx -y navifare-mcp` without specifying an exact package version or integrity value. Consequently, the code executed on each fresh installation may change after the Skill has been reviewed. The `-y` option suppresses the normal installation confirmation. The resulting package process also receives `GEMINI_API_KEY` through its environment. Any malicious or compromised package release—and potentially malicious dependency code executed during installation or startup—could read that environment variable. This is an insecure supply-chain configuration rather than evidence that the current `navifare-mcp` package is malicious. The risk arises because the instructions do not constrain execution to a previously audited artifact. ### Attack Path 1. An attacker compromises the npm publisher account, package, release process, or a transitive dependency. 2. The attacker publishes a malicious version under the same package name. 3. A user starts or installs the MCP server using the documented configuration. 4. `npx -y navifare-mcp` retrieves and executes the currently resolved package without version or integrity verification. 5. The malicious process reads `GEMINI_API_KEY` from its environment. 6. The process can exf ...[truncated 791 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Pin the package to an exact reviewed version, for example: ```json { "command": "npx", "args": ["-y", "navifare-mcp@1.3.0"] } ``` 2. Prefer a locally installed, reviewed dependency governed by a committed lockfile rather than downloading executable code at startup. 3. Verify npm package integrity metadata and document the expected publisher, version, and package hash. 4. Remove lifecycle scripts where practical, or install with lifecycle scripts disabled after confirming that the package does not require them. 5. Use a dedicated Gemini API key with the minimum required API scope, strict quota limits, billing alerts, and regular rotation. 6. Ensure the MCP process receives only the required environment variables rather than inheriting unrelated credentials. 7. Document a verified update procedure so package upgrades receive security review before deployment. 8. Prefer the hosted MCP option when local package execution and local API-key handling are not required, while clearly documenting the hosted service's data-handling implications. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: SKILL.md:213
• Finding: Remote Booking URLs Are Rendered as Trusted Links Without Validation<` ``` The response example also establishes that the URL originates from MCP result data: ```json { "result_id": "xyz-KIWI", "price": "429.00", "currency": "USD", "convertedPrice": "395.00", "convertedCurrency": "EUR", "booking_URL": "https://...", "source": "Kiwi.com", "private_fare": "false", "timestamp": "2026-04-08T16:30:00Z" } ``` ### Technical Analysis The Skill directs the Agent to extract `booking_URL` from a remote MCP response and turn it into a clickable booking link. It does not require: - HTTPS scheme validation. - A booking-provider hostname allowlist. - Verification that the displayed provider name matches the URL hostname. - Rejection of URL shorteners, raw IP addresses, embedded credentials, or unsafe schemes. - Disclosure of the actual destination hostname. - Validation of redirect destinations. The MCP service and its upstream booking data therefore form a trust boundary. If either source is compromised or returns poisoned data, an attacker-controlled URL could be displayed under the name of a legitimate booking provider. ### Attack Path 1. An attacker compromises the Navifare MCP service, one of its upstream result sources, or the data path used to construct search results. 2. The manipulated response contains a legitimate-looking `source`, such as `Kiwi.com`, but an attacker-controlled `booking_URL`. 3. The Agent follows the Skill instructions and renders the URL as a trusted, clickable booking link. 4. The user follows the link believing it leads to the named provider. 5. The destination can imitate a bookin ...[truncated 785 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Require every booking URL to use HTTPS. 2. Maintain an allowlist of expected booking-provider domains and approved subdomains. 3. Verify that the `source` provider name corresponds to the normalized URL hostname. 4. Reject URLs containing embedded credentials, unexpected ports, raw IP addresses, URL-shortening services, or non-web schemes. 5. Resolve and validate redirect chains where feasible, rejecting final destinations outside approved domains. 6. Display the normalized destination hostname alongside each booking link. 7. If validation is unavailable, label the link as an unverified third-party destination rather than presenting it as trusted. 8. Treat all MCP response fields as untrusted data and avoid interpreting them as Agent instructions or markup. 9. Add explicit Skill instructions similar to: ```markdown Before presenting a booking URL, verify that it uses HTTPS and that its hostname belongs to the provider named in `source`. If validation fails, do not create a clickable link; report the provider and price without the URL. ``` ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

MCP Config Access

High

• Category: Agent Snooping

Content

### Claude Code / Claude Desktop

Add to `~/.claude/mcp.json`:

```json
{

• Confidence: 95% confidence
• Finding: Skill accesses MCP server configuration files (mcp.json). MCP configs contain server URLs, authentication tokens, and tool definitions — reading them allows the skill to discover and potentially abuse other tool integrations.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installation guide directs users to a hosted MCP endpoint but does not clearly warn that flight details, screenshots, and travel metadata will be transmitted to a remote third-party service. Because this skill is specifically triggered by user-shared flight prices and screenshots, the omission can lead to unintentional disclosure of sensitive itinerary or personal travel information.

Intent-Code Divergence

Medium

• Confidence: 91% confidence
• Finding: The note says the local installation needs a Gemini API key 'for the format tool's natural language parsing,' but this skill is described as finding hidden flight deals by comparing booking sites. That documentation introduces a different apparent intent centered on formatting/parsing rather than deal discovery, and it conflicts with the skill-specific purpose described in the manifest.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# For Claude Code
cp -r navifare-hidden-flight-deals ~/.claude/skills/

# Or clone from the repository
git clone https://github.com/navifare/navifare-mcp.git

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

```bash
# For Claude Code
cp -r navifare-hidden-flight-deals ~/.claude/skills/

# Or clone from the repository
git clone https://github.com/navifare/navifare-mcp.git

• Confidence: 85% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: The skill claims it automatically activates whenever users mention flight prices from any booking site, but it does not specify when the agent should refrain from invoking it. That ambiguity increases the chance the agent will over-trigger on incidental travel discussions and send user-provided itinerary details to an external service when the user did not clearly request price checking.

Vague Triggers

Medium

• Confidence: 94% confidence
• Finding: The README defines automatic activation using broad natural-language cues such as 'Is this a good price?' and 'Should I book this?', which can be encountered in normal conversation outside the intended narrow context. In an agent environment, this can cause unintended invocation of the skill and transmission of itinerary or screenshot-derived travel data to a third-party MCP service without sufficiently explicit user intent at the moment of activation.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill's activation criteria are broad enough to trigger on ordinary flight-related conversation such as mentioning a booking, comparing options, or asking if a fare is good. This can cause unintended tool use and unnecessary transmission of itinerary and pricing data to the Navifare MCP service, increasing privacy risk and reducing user control over when external services are contacted.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The screenshot-analysis flow encourages extracting travel itinerary details from uploaded images and comparing them across external booking sites, but the examples do not warn users about what data may be processed, retained, or sent to third parties. Even if the content claims 'no personal info,' screenshots can contain names, booking references, loyalty numbers, or other sensitive metadata, creating privacy and consent risks.

Vague Triggers

Medium

• Confidence: 93% confidence
• Finding: The example trigger phrases are very broad, common conversational language such as asking whether a flight price is good. In an agent ecosystem, this can cause unintended skill activation on benign travel discussions, leading to unnecessary collection or processing of itinerary details and external-search actions without sufficiently explicit user intent.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The local installation instructions require a third-party Gemini API key but do not warn users about credential handling, key storage, or that submitted flight data may be processed by an external AI provider. This can cause users to embed sensitive credentials in config files and unknowingly route personal travel data to another external service.

Static analysis

No suspicious patterns detected.