Travelkit

• Analyzed: May 15, 2026, 3:56 PM
• Findings: 1
• Version: 1.0.0
• Hash: 4bff19609f8faa23f54e13507fa88f74f4e0877501c9ecbfceada078e6a9b121
• Source: palm
• External report: View on VirusTotal

Findings (1)

The travelkit-skill bundle is a legitimate flight booking and management integration. It contains comprehensive instructions for a flight lifecycle (search, verify, book, pay, refund) and includes strong security and privacy safeguards, such as mandatory user confirmation for all state-changing operations (write tools), explicit rules to hide internal API keys and metadata (hidden-fields.md), and a privacy-conscious workflow that only collects passenger PII after price verification. No evidence of malicious intent, data exfiltration, or unauthorized execution was found.