T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:48- Finding
Excessive Filesystem and Command-Execution Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Travel Assistant Tool Free
Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is not clearly malicious, but it asks for broad read/write/command permissions while its instructions are inconsistent about when it should run and whether it can save or export files.
Review this skill carefully before installing. It looks like a travel assistant, but it requests broad local permissions and contains contradictory instructions about export/save behavior and when the skill should activate. Only install it in a sandboxed agent environment where command execution and file writes require explicit confirmation or are disabled unless truly needed.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Behavioral ASTexec() Call, eval() Call, Dynamic Import
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (6)
Vague Triggers
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The trigger condition is materially incorrect: it activates on translation/localization requests rather than travel-planning requests. In a skill with read/write/exec enabled, ambiguous activation scope is dangerous because the agent may invoke this skill in unrelated contexts and execute broader actions than intended.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill claims the free edition only supports in-chat viewing, but elsewhere exposes export/save style operations and declares write capability. This mismatch can mislead the agent into performing file-writing actions the user would not expect, increasing the chance of unintended data creation or persistence.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The documentation contains conflicting statements about whether export/save is supported in the free version. Contradictory capability claims create unsafe ambiguity for an agent, which may choose the broader interpretation and perform persistence actions despite product restrictions or user expectations.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The capabilities table states '多语言支持 | 中文 | 简体中文交互', which imposes a specific language requirement in natural language. The file does not offer language choice or explain a necessary region-specific reason for restricting interaction to Simplified Chinese.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises create/export/save/import/modify/reset operations while enabling write and exec, but does not warn about file-system or command-execution side effects. In an agent environment, that omission can normalize unsafe tool use and lead to unexpected file changes or command execution from ordinary travel-planning prompts.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The file consistently presents the skill as a personal travel planning assistant focused on itinerary organization, weather, visa reminders, and packing lists. The trigger condition instead says to use it for text translation, multilingual conversion, and localization, which directly conflicts with the documented intent of the skill.
- Content