Security audit

travel-assistant

Security checks for vulnerabilities and agentic risk

Overview

The skill advertises travel help but also requests broad file and command permissions with vague automation language, so it should be reviewed before installing.

Install only if you are comfortable giving a travel-planning skill broad file and shell-command authority. Prefer a version limited to travel lookups and itinerary writing, with exec removed or restricted by a real command allowlist and explicit user confirmation before any write or command action.

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The skill is presented as a travel assistant, but its manifest and body expand scope into generic automation with read/write/exec capabilities. This creates a misleading trust boundary: users or orchestrators may invoke a seemingly low-risk travel skill that can actually perform broad system actions unrelated to travel planning.

Context-Inappropriate Capability

High

Confidence: 97% confidence
Finding: Declaring general shell execution for a travel-planning skill is unjustified and materially increases attack surface. If the skill is auto-invoked from broad prompts, an attacker could steer it into executing arbitrary commands, leading to host compromise, data access, or pivoting far beyond the travel domain.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The file claims that only whitelisted commands are executed, but no actual whitelist or enforcement mechanism is defined while a general exec capability is exposed. This kind of unenforced security claim can create false assurance and leaves downstream systems vulnerable to arbitrary command use if they trust the documentation.

Vague Triggers

High

Confidence: 90% confidence
Finding: The invocation language is overly broad and explicitly targets generic efficiency, automation, batch processing, and workflow optimization rather than travel tasks. In an agent ecosystem, this makes accidental or adversarial invocation more likely, allowing a travel-branded skill with powerful tools to activate in unrelated contexts and misuse its capabilities.

Vague Triggers

Medium

Confidence: 78% confidence
Finding: The quick-start section provides generic usage steps but no concrete trigger phrases, eligibility rules, or boundaries for when the skill should activate. That ambiguity increases the chance of over-broad routing and unintended use, especially because the skill also advertises powerful non-travel capabilities.

Static analysis

No suspicious patterns detected.