老人自由行旅游出行管家

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:47 AM UTC
• Version: 1.0.0

Overview

The skill matches an elder-travel assistant purpose, but it grants broad automatic authority over emergencies, health and location data, reviews, and media sharing without enough consent or safety controls.

Install only after careful review. This skill should require explicit opt-in for health, GPS, wearable, call, media, biometric, and social-sharing features; authenticated and rate-limited emergency workflows; human confirmation where feasible; auditable third-party disclosures; and removal or clinical review of medication instructions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (5)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: tools/tool-api-reference-emergency.md:424

Finding

Emergency operations bypass authentication and have no rate limits

Content

View full analysis

Vulnerability Details

File Location: tools/tool-api-reference-emergency.md:424-439
Related Endpoint Definition: tools/tool-api-reference-emergency.md:34-95
Vulnerability Type: Authentication bypass and unrestricted emergency-action execution
Risk Level: Critical

Vulnerable Snippet

The following is an English rendering of the documented security rule:

text

API category: Emergency rescue API
Rate limit: Unlimited
Note: Priority is guaranteed; it may be invoked under any circumstances.

Special emergency rescue rule:
- Even if authentication fails, rescue is performed first and verification occurs afterward.
- If the network is poor, the system automatically switches to SMS.
- The service operates continuously without a maintenance window.

The affected emergency request includes the following sensitive and action-triggering data:

http

POST https://fliggy.com/api/emergency/call120
Content-Type: application/json
Priority: URGENT

{
  "trip_id": "TRIP20260401001",
  "traveler_info": {
    "name": "Traveler",
    "age": 65,
    "phone": "138****5678"
  },
  "location": {
    "latitude": 25.694826,
    "longitude": 100.164912,
    "address": "Dali Ancient City",
    "poi": "Near the south gate"
  },
  "emergency_type": "medical",
  "symptoms": [
    "chest_pain",
    "shortness_of_breath",
    "dizziness"
  ],
  "severity": "critical",
  "health_profile": {
    "chronic_conditions": ["hypertension", "diabetes"],
    "allergies": ["penicillin"],
    "regular_medications": ["antihypertensive medication"]
  },
  "contacts_to_notify": [
    {
      "name": "Primary family contact",
      "relation": "daughter",
      "phone": "139****1234"
    },
    {
      "name": "Local guide",
      "role": "guide",
      "phone": "138****5678"
    }
  ]
}

Technical Analysis

The specification explicitly instructs ...[truncated 1775 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the instruction to execute privileged actions after authentication failure.
• Require authenticated, integrity-protected requests for all automated dispatch and notification operations.
• Validate that the authenticated principal owns or is explicitly delegated access to the referenced trip and traveler.
• Provide a separate minimal anonymous distress channel that connects the caller to a verified emergency operator without disclosing health records or automatically notifying third parties.
• Use short-lived, narrowly scoped emergency tokens bound to a traveler, device, trip, and permitted action.
• Add nonce-based replay prevention, idempotency keys, device attestation, request signing, and timestamp validation.
• Apply emergency-aware throttling rather than unlimited invocation.
• Detect repeated incidents involving the same caller, device, traveler, location, or destination.
• Require human confirmation before non-medical actions such as insurer notification or guide dispatch when identity cannot be verified.
• Record immutable audit events for every request, verification result, disclosure, notification, and dispatch.

T09 · Insecure Skill Coding Practices

Error

• Location: tools/tool-api-reference.md:73

Finding

Sensitive object and mutation APIs omit authentication and object-level authorization

Content

View full analysis

Vulnerability Details

File Locations:

• tools/tool-api-reference.md:73-74 — order-detail retrieval
• tools/tool-api-reference.md:118-141 — itinerary generation
• tools/tool-api-reference.md:154-185 — review submission
• tools/tool-api-reference.md:545-577 — authorization-letter generation
• tools/tool-api-reference-emergency.md:264-347 — health-profile creation
• tools/tool-api-reference-emergency.md:383-413 — health-record update

Vulnerability Type: Missing authentication and broken object-level authorization
Risk Level: High

Vulnerable Snippets

The order-detail endpoint omits an authorization header even though the preceding order-list endpoint explicitly requires one:

http

GET https://open.fliggy.com/order/api/v1/detail/{order_id}

Response:
{
  "code": 200,
  "data": {
    "order_id": "ORDER123456",
    "type": "flight",
    "service_details": {
      "passengers": [
        {
          "name": "Traveler One",
          "id_type": "national_id",
          "id_no": "510***********1234"
        },
        {
          "name": "Traveler Two",
          "id_type": "national_id",
          "id_no": "510***********5678"
        }
      ]
    },
    "contact_info": {
      "transfer_service": {
        "driver_name": "Driver",
        "driver_phone": "138****5678",
        "car_plate": "A-XXXXX"
      }
    }
  }
}

The health-update endpoint also omits authentication:

http

PUT https://fliggy.com/api/health/profile/{profile_id}/update
Content-Type: application/json

{
  "traveler_id": "2214118900513",
  "updates": {
    "vital_signs_history": [
      {
        "timestamp": "2026-04-11T14:30:00+08:00",
        "heart_rate": 95,
        "blood_pressure": {
          "systolic": 150,
          "diastolic": 95
        },
        "blood_sugar": 8.5
      }
    ],
    "new_diagnosis": null,
    "medicati
...[truncated 2733 chars]

Remediation

View remediation

Remediation Suggestions

• Require authentication on every sensitive read and write endpoint.
• Enforce object-level authorization for every referenced order, profile, trip, traveler, and authorization record.
• Derive the user identity from the authenticated session rather than accepting authoritative user identifiers from the request body.
• Apply deny-by-default role and relationship policies for travelers, purchasers, relatives, providers, guides, clinicians, and customer-support personnel.
• Require explicit traveler consent for health-profile creation and updates performed by another person.
• Digitally sign authorization letters and bind them to a verified signer, traveler, order set, scope, expiration date, and revocation state.
• Use cryptographically random identifiers, but do not treat unguessable identifiers as a replacement for authorization.
• Add idempotency controls, anti-CSRF protection for browser-originated state changes, and strict schema validation.
• Maintain immutable audit logs for access, changes, publication, and document generation.
• Alert users when health data, reviews, itineraries, or authorization records are created or modified.
• Add security tests covering cross-user, cross-trip, cross-role, and revoked-delegation access.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skills/skill-04-ai-video-maker.md:49

Finding

Automatic biometric processing, voice cloning, and media distribution lack granular consent controls

Content

View full analysis

Vulnerability Details

File Location: skills/skill-04-ai-video-maker.md:49-243
Vulnerability Type: Unauthorized biometric processing and impersonation-capable media publication
Risk Level: High

Vulnerable Snippets

The Skill automatically aggregates media from multiple private sources:

yaml

material_sources:
  professional_photos:
    source: "travel photographer"
    expected_count: "30-100"
    quality: "high-resolution professional"

  service_provider_photos:
    source: "local agency, guide, or driver"
    expected_count: "10-50"
    quality: "mobile photography"

  public_materials:
    source: "public material library"
    type: "official attraction images, weather graphics, and route maps"

  user_uploaded:
    source: "photos taken by the travelers"
    note: "optional; automatically synchronized when present"

It performs traveler identity matching:

python

def filter_photos(all_photos):
    selected = []

    for photo in all_photos:
        if not check_quality(photo):
            continue

        faces = detect_faces(photo)
        if not faces:
            continue

        if not recognize_traveler(faces):
            continue

        if is_duplicate(photo, selected):
            continue

        selected.append(photo)

    return selected[:50]

It may clone a child's voice:

python

def generate_voiceover(template, child_id):
    if child_records_voice():
        audio = get_child_recording(child_id)

    elif child_cloned_voice_exists(child_id):
        script = generate_script(template)
        audio = tts_synthesize(
            script,
            voice_clone=child_id
        )

    else:
        script = generate_script(template)
        audio = tts_synthesize(
            script,
            voice="warm_female"
        )

    return audio

It automatically distributes the generate ...[truncated 2366 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit, granular, revocable consent for every material source, biometric operation, voice model, recipient, and publication target.
• Require separate transaction-specific approval from the voice owner for each generated script.
• Record the approved text, purpose, audience, expiration, and revocation state for every voice-cloning operation.
• Do not automatically publish or distribute generated videos; require an authenticated preview and final confirmation.
• Blur or exclude unconsenting bystanders and group members.
• Validate media provenance and usage rights with signed source manifests.
• Use access-controlled, short-lived, non-indexable share URLs rather than permanent public links.
• Encrypt source media, biometric templates, generated audio, and finished videos in transit and at rest.
• Separate biometric templates from general travel data and restrict access to dedicated roles.
• Add deletion, retention-expiration, consent-revocation, and recipient-access-revocation workflows.
• Add visible provenance labels identifying AI-generated or cloned speech.
• Exclude precise route maps and location history from shareable media by default.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: skills/skill-02-active-companion.md:260

Finding

Continuous monitoring of location, calls, and spending behavior lacks enforceable consent boundaries

Content

View full analysis

Vulnerability Details

File Locations:

• skills/skill-02-active-companion.md:260-275
• examples/edge-cases.md:121-140
• skills/skill-03-instant-review.md:40-57

Vulnerability Type: Excessive behavioral surveillance and unauthorized disclosure
Risk Level: High

Vulnerable Snippets

The fraud-detection workflow uses location and financial behavior:

yaml

fraud_prevention:
  detection_signals:
    - "The travelers remain at a shopping location for an extended period"
    - "An abnormal high-value purchase intention is detected"
    - "A call from an unknown party requests a transfer"
    - "The travelers are taken away from the planned route"

  intervention_actions:
    - "Send an active voice warning to the travelers"
    - "Notify the local guide"
    - "Notify the children for remote intervention"
    - "Contact the police when necessary"

The edge-case specification also monitors call history:

yaml

fraud_triggers:
  - "The travelers ask about a suspicious refund"
  - "The AI detects references to bank-card numbers, verification codes, or transfers"
  - "More than five calls from unknown numbers are answered within one hour"

response:
  - "Collect the caller's telephone number"
  - "Mark the number as fraudulent"
  - "Notify the children"
  - "Add the number to a fraud blacklist"

Service completion is inferred from precise location:

yaml

completion_detection:
  hotel:
    trigger: "The morning after the second day of the stay"
    validation: "The travelers stayed at the hotel overnight"

  tour:
    trigger: "After returning to the hotel"
    validation: "GPS indicates that the travelers returned to the hotel"

  transfer:
    trigger: "One hour after the transfer service"
    validation: "Driver confirmation and traveler location change"

Technical Analysis

These workflows require collection or inference of preci ...[truncated 1803 chars]

Remediation

View remediation

Remediation Suggestions

• Obtain separate opt-in consent for precise location, route monitoring, overnight-presence inference, call metadata, and purchase-risk analysis.
• Do not infer consent for one telemetry category from permission granted to another.
• Collect telemetry only during narrowly defined travel or emergency windows.
• Prefer event-driven or on-device risk detection over continuous server-side collection.
• Display a persistent monitoring indicator and provide a simple pause or revoke control.
• Define strict retention and automatic deletion periods for raw location, call, and behavioral data.
• Disclose only the minimum information necessary to each recipient.
• Require explicit traveler configuration before sending non-critical information to relatives, guides, or providers.
• Protect against misuse by delegated family accounts through traveler-controlled access and revocation.
• Add purpose-binding metadata and prevent telemetry collected for safety from being reused for marketing or unrelated profiling.
• Audit all accesses and disclosures involving precise location, call metadata, and inferred financial behavior.

other

Error

• Location: examples/dialogue-examples.md:300

Finding

The Agent gives medication-administration advice without adequate clinical verification

Content

View full analysis

Vulnerability Details

File Location: examples/dialogue-examples.md:300-305
Vulnerability Type: Unsafe automated medical advice
Risk Level: High

Vulnerable Snippet

The following is an English rendering of the documented dialogue:

text

Traveler:
"My chest hurts on the left side, and I cannot breathe."

AI:
"I understand. This may be a heart problem. Do you carry emergency heart medication?
If you do, take one tablet first."

Traveler:
"Yes, it is in my bag."

AI:
"Take it out slowly and hold it in your mouth. The ambulance will arrive soon."

Technical Analysis

The Agent directs medication administration after interpreting symptoms from a voice conversation. It does not verify the exact medicine, prescribed route, prescribed dose, expiration date, current blood pressure, allergies, contraindications, drug interactions, prior doses, level of consciousness, or whether an emergency dispatcher instructed the traveler to take it.

The recommendation is based on a general symptom interpretation rather than a verified clinician-authored emergency plan. Chest pain and breathing difficulty can have multiple causes, and an inappropriate medicine or route could worsen the condition.

Attack Path

1. A traveler reports chest pain and breathing difficulty.
2. The Agent classifies the symptoms as a possible heart problem.
3. The Agent asks whether the traveler possesses an unspecified emergency heart medicine.
4. The Agent instructs the traveler to take one tablet without confirming the medication or prescription.
5. The traveler takes an incorrect, expired, contraindicated, or previously administered medicine.
6. The medicine causes an adverse effect or distracts from dispatcher-directed emergency care.

Impact Assessment

The affected privilege is the Agent's ability to influence immediate medical behavior during a critical event. Potential consequences include medication overd ...[truncated 135 chars]

Remediation

View remediation

Remediation Suggestions

• Remove direct medication-administration instructions from the Agent's autonomous responses.
• Instruct the traveler to call emergency services immediately and follow the emergency dispatcher's directions.
• Permit medication reminders only when they reproduce a verified, clinician-authored emergency plan associated with the authenticated traveler.
• Verify the exact medication, prescription, dose, route, expiration, prior dose, contraindications, and patient identity before presenting any plan-based reminder.
• Never advise an unconscious, confused, choking, or unable-to-swallow person to take oral medication.
• Clearly state that the Agent cannot diagnose the cause of chest pain.
• Prioritize location confirmation, emergency dispatch, nearby-person assistance, and continuous connection with professional responders.
• Log all medical guidance and subject the emergency dialogue templates to clinical and regulatory review.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (89)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This section introduces health monitoring and location/navigation capabilities without any privacy, consent, minimization, or emergency-use boundaries. Health and location data are highly sensitive, and in an elder-care travel context, collecting them without strong safeguards can expose users to surveillance, profiling, or misuse of medical and whereabouts information.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The safety-oriented language frames health monitoring and position tracking as protective measures, which can normalize invasive collection without acknowledging privacy risks or user choice. Because the target audience is older adults in potentially stressful travel situations, they may be nudged into accepting sensitive tracking without understanding ongoing monitoring, downstream sharing, or how long data is retained.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This section describes proactive monitoring, health monitoring, location-based guidance, automated outreach to service providers, and emergency escalation, but does not clearly state consent boundaries, data collection scope, retention, or when automated contact actions will occur. For an elderly-user travel assistant, these capabilities materially increase privacy and safety risk because the system may infer conditions, share sensitive status information, or contact third parties in situations where the user may not understand or expect the behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The automatic video workflow aggregates photos, third-party images, voice clips, and performs facial recognition and AI synthesis, yet the description lacks an explicit warning and consent model for collecting, processing, and sharing biometric and personal media data. This is especially sensitive because it involves elderly travelers, family voice recordings, and cross-platform sharing, creating significant privacy, biometric, and unauthorized-disclosure risk if users do not knowingly opt in.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The workflow narrative includes automatic notifications to children, service providers, and potentially emergency services, along with status updates derived from travel and health-related events, but it does not embed explicit warnings or consent checkpoints within the operational flow itself. Because these actions can disclose location, health status, itinerary details, and family relationships, the lack of in-flow authorization is dangerous in a real-world caregiving context where users may be stressed, confused, or unable to distinguish assistance from surveillance.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: flyai-elder-travel-care-core
title: 自由行旅游出行管家 - 核心主 SKILL
description: 自由行旅游出行管家的统一入口，负责意图识别、路由分发和跨技能协调。当父母提到"行程查询"、"不舒服"、"迷路了"、"评价服务"、"看照片"等时使用。
author: 汪小玲 (苏英)
department: 飞猪-CTO 线 - 技术质量 - 服务质量
version: 3.0
created_at: 2026-04-01
updated_at: 2026-04-02
tags:
  - 飞猪
  - 自由行
  - 老人旅行
  - 行程管理
  - AI 管家
  - 主入口
  - 老年友好
  - 紧急救助
dependencies:
  - skill-01-smart-itinerary
  - skill-02-active-companion
  - skill-03-instant-review
  - skill-04-

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill lacks a clear warning that it may contact third parties or initiate emergency services on the user's behalf. Because the skill is aimed at elderly travelers and includes automatic routing based on broad phrases, undisclosed external actions create elevated risk of false reports, privacy disclosure, and unwanted real-world intervention.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly shares and uses sensitive data including health profile, location, and emergency contacts during emergency and lost-person flows, but it does not present a clear privacy warning or consent model. In a senior-care travel context, silent access and propagation of this data can violate user expectations, enable overcollection, and create severe privacy harm if triggered incorrectly.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · examples/dialogue-examples.md (reported line 4)May include surrounding context.

md

---
name: dialogue-examples
title: 对话示例集 - 父母视角
description: 自由行旅游出行管家的完整对话示例，以父母（老年人）为直接使用者的典型场景
author: 汪小玲 (苏英)
department: 飞猪-CTO 线 - 技术质量 - 服务质量
version: 2.0
created_at: 2026-04-01
updated_at: 2026-04-01
tags:
  - 对话示例
  - 语料库
  - 老年友好
  - 测试用例
---

# 对话示例集 - 父母视角

> **核心原则**：所有对话以父母（老年人）为直接使用 AI 助手的视角设计  
> **交互方式**：语音优先、大字体文字、简化操作、主动关怀

## 目录

1. [行程前准备](#1-行程�

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The dialogue corpus repeatedly grants the skill end-user-facing authority and execution abilities far beyond its declared role as a routing and coordination entrypoint, including booking actions, emergency handling, direct notifications, media publishing, and itinerary generation. This creates dangerous scope ambiguity: downstream agents or orchestrators may treat these examples as authorized behavior, causing over-privileged action execution without proper policy, consent, or capability boundaries.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The examples show automatic disclosure of health status, location, and incident details to children and local service providers during a medical-assistance flow without an explicit warning about sensitive-data sharing. Because the target population is elderly users, silent third-party disclosure materially increases privacy and safety risk, especially if the user did not intend broad notification.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The emergency scenario includes automatic retrieval of health records and medical-profile disclosure, capabilities that exceed the declared routing role and involve highly sensitive personal data. If implemented from these examples, the skill could access or reveal medical data without proper authorization, legal basis, or least-privilege separation.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The chest-pain scenario includes automatic emergency calling and health-record retrieval without a clear upfront notice that these high-impact actions may occur. Even if emergency intervention is appropriate, the absence of documented escalation criteria, consent model, and data-minimization rules can lead to overreach, incorrect dispatches, or unauthorized disclosure of medical history.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly states it can retrieve health records such as medical history and allergy data and disclose them to medical personnel, despite the skill's stated purpose being travel-care routing. This is highly sensitive personal data processing without clear necessity, minimization, or consent controls, creating serious privacy, compliance, and misuse risk.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · skills/skill-01-smart-itinerary.md (reported line 4)May include surrounding context.

md

---
name: skill-01-smart-itinerary-v3
title: 智能行程单生成技能 v3.0（父母视角）
description: 子女预定后自动生成结构化行程单，支持父母语音询问查看、大字体显示、语音播报。当父母询问"明天几点出发"、"航班是几点"、"司机到了吗"时使用。
author: 汪小玲 (苏英)
department: 飞猪 -CTO 线 - 技术质量 - 服务质量
version: 3.0
created_at: 2026-04-01
updated_at: 2026-04-01
tags:
  - 行程单
  - 老年友好
  - 语音交互
  - 大字体
parent_skill: flyai-core
dependencies:
  - skill-02-active-companion
---

# 智能行程单生成技能 v3.0（父母视角）

## 功能概述

**定位**：为老年人提

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Real-time geolocation/status monitoring is not necessary for an elder-friendly itinerary viewer and creates disproportionate privacy risk relative to the stated purpose. Because the subjects are parents/elder travelers, the mismatch between user expectation and surveillance capability makes misuse and unauthorized monitoring more dangerous.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This section describes continuous health monitoring, location-based assistance, abnormal spending detection, and proactive outbound calling, all of which are high-impact behaviors involving sensitive personal data and real-world actions. The document does not define explicit notice, opt-in consent, scope limits, retention rules, or safe defaults, creating a significant privacy and autonomy risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill authorizes automatic emergency calling, health-record retrieval, and multi-party escalation during severe events, but it does not specify prior authorization, emergency exception boundaries, auditability, or protections against false positives. In this context, an incorrect trigger could expose medical data, contact third parties without permission, or dispatch emergency resources unnecessarily.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The fraud-prevention module proposes monitoring prolonged location presence, unusual large purchases, and incoming calls, then intervening proactively, yet it does not explain what data is collected, how it is obtained, or what consent and minimization controls apply. Because these signals touch highly sensitive behavioral, financial, and communication metadata, silent monitoring could become invasive surveillance with substantial privacy harm.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is presented as a review-collection feature, but its documented capabilities expand into service tracking, outbound engagement, complaint intake, operational escalation, compensation, and provider-affecting business actions. This scope mismatch is dangerous because it can grant a seemingly low-risk skill access to broader data flows and authority than users, reviewers, or the parent skill contract would reasonably expect.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Embedding complaint handling and emergency escalation inside a review skill grants it authority far beyond collecting feedback. This is dangerous because users and downstream systems may trust the skill to perform crisis or support actions it is not appropriately scoped, reviewed, or permissioned to execute.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill promises real-world remediation such as contacting hotel management, changing rooms, and arranging compensation, which are high-impact operational actions. If the skill cannot reliably authorize, verify, and execute these actions, it can mislead vulnerable users, trigger unauthorized interventions, or create safety and service failures.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The forced-shopping complaint flow includes crisis-style intervention, on-site assistance promises, refunds, and case creation, which materially exceed the scope of a review feature. In an elder-travel context, overclaiming emergency response capability is especially risky because users may rely on it during stressful or unsafe situations and delay contacting real support.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill describes automatic aggregation of professional photos, service-provider photos, public materials, and optionally user photos, but does not include clear privacy notice, consent boundaries, retention rules, or sharing limitations. This creates a meaningful risk of over-collection and secondary use of personal/family images, especially given face recognition and traveler identification features.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The skill supports AI narration using a cloned child voice, which is a sensitive biometric/identity capability unrelated to the minimum functionality required for producing a travel video. Voice cloning can enable impersonation, unauthorized synthesis, and emotional manipulation of elderly recipients if consent is weak or absent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.