Korea Domestic Flights

• Outcome: Review
• Latest audit: Sep 12, 2026 · 7:17 AM UTC
• Version: 0.6.4

Overview

This flight-search skill is mostly coherent, but it needs Review because it executes an unpinned local scraper dependency and can write alert-store JSON to arbitrary user-supplied paths.

Install only if you trust and control the local tmp/Scraping-flight-information repository used by the skill. Prefer pinning or verifying that dependency before use, and keep price-alert storage at the default path unless you intentionally choose another file. There is no artifact-backed evidence of credential theft, exfiltration, or destructive behavior, but the dependency and file-write scope deserve manual review.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: scripts/search_domestic.py:145

Finding

Unverified External Repository Is Imported and Executed as Trusted Code

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/price_alerts.py:56

Finding

Unrestricted Alert Store Path Allows Arbitrary File Creation and Overwrite

Content

View full analysis

None: path.parent.mkdir(parents=True, exist_ok=True) data["updated_at"] = now_iso() path.write_text(json.dumps(data, ensure_ascii=False, indent=2) + "\n", encoding="utf-8") ``` The path is accepted directly from the command line without confinement: ```python parser = argparse.ArgumentParser(description="대한민국 국내선 가격 감시 규칙 저장/점검 도구") parser.add_argument("--store", default=str(DEFAULT_STORE), help="규칙 JSON 저장 파일 경로") ``` Multiple commands pass that value directly to `Path` and subsequently save it: ```python def command_add(args) -> int: store_path = Path(args.store) data = load_store(store_path) ``` ```python def command_check(args) -> int: store_path = Path(args.store) data = load_store(store_path) ``` ```python def command_remove(args) -> int: store_path = Path(args.store) data = load_store(store_path) ``` ### Technical Analysis The global `--store` option accepts absolute paths and path traversal without validation. The selected path is used for both reading and writing. `save_store` also creates missing parent directories. There are no controls to ensure that the resolved path remains within the Skill's intended data directory. The implementation also lacks: - Symbolic-link rejection - File ownership checks - Atomic replacement - Restrictive file permission enforcement - Confirmation before writing outside the default location - Protection against concurrent writers - Backup or recovery behavior For existing files, `load_store` requi ...[truncated 1881 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (26)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared description presents a user-facing domestic airfare skill with rich capabilities: finding lowest fares, comparing routes, handling one-way/round-trip/date ranges, applying time preferences, exploring optimal date-destination combinations, and saving/checking price alerts. The supplied code chunk does not implement those behaviors. Instead, it is explicitly labeled as a 'Shallow live dry-run / DOM drift sanity check' script. Its main function checks whether a repository exists, tries to import ParallelSearcher, and optionally performs a minimal probe call to validate that the scraper can execute without asserting fare availability. The output is a diagnostic JSON report about environment health and probe success, not airfare results or monitoring state. While it is related to the same domain and may support the broader skill, this chunk’s actual purpose is materially different from the declared end-user functionality, so this should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description presents an end-user airfare workflow for Korean domestic flights. The supplied code instead implements internal analytics around previously produced broad/detailed search rows: reason labeling, extraction coverage metrics, summary text generation, user/developer hints, and fallback-plan selection. While these diagnostics could support a flight-search system, this chunk’s primary behavior is observability and retry planning, not airfare search or monitoring itself. That is a material description-behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The declared description presents a user-facing airfare workflow for Korean domestic flights, including searching routes, comparing fares, exploring date ranges, and monitoring target prices. The supplied code does none of that. Instead, it is an internal test/smoke-check script that reads fixture data from a local JSON file, invokes diagnostic/fallback functions, and asserts expected outputs for test cases. There is no browser automation, no flight-provider interaction, no pricing retrieval, no airport/date query handling, and no alerting functionality. This is a clear material mismatch in primary purpose and capabilities.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The code substantially matches part of the description: it supports Korean domestic flight search, airport-name normalization, natural-language date parsing, one-way/round-trip queries, and time-preference-based ranking/briefing. However, the declared description is broader than what this code chunk actually does. This script only performs a single-route search and summarization flow via an externally imported FlightSearcher. It does not show any implementation for monitoring prices, storing alerts, checking saved alerts, scanning date ranges for lowest fares, comparing several destinations, or optimizing across destination/date combinations. Those are material user-facing capabilities in the description, so this is a description-to-behavior mismatch for the supplied code chunk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The skill description states in Korean that this is a skill for domestic flight search in Korea, and the examples and input guidance throughout the README assume Korean-language inputs such as airport names and natural-language date phrases. There is no indication that other languages are supported or that users may opt in to Korean-only behavior, which can violate a language/locale choice policy.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill advertises and documents shell execution, file reads, and file writes via local Python scripts and persisted alert state, but it declares no explicit tool scope or permissions boundary. In an agent environment, this increases the chance the skill can be invoked with broader host access than intended, making misuse or unexpected side effects harder to constrain or audit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The file states that output defaults to a human-readable Korean briefing unless --json is used. This is a language policy concern because it imposes a specific language by default without indicating that the user can choose another language or opt in to Korean output.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/chat_search.py (reported line 16)May include surrounding context.

python

def run_script(script_name: str, extra_args: list[str]) -> int:
    command = [sys.executable, str(SCRIPT_DIR / script_name), *extra_args]
    return subprocess.call(command)


def time_args(args) -> list[str]:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This file hard-codes Korean airport names, weekday terms, time buckets, and multiple Korean-only parsing patterns and user-facing messages, which constrains core skill behavior to a specific language/locale. Although a few English aliases exist, the main natural-language interpretation path is not presented as an optional locale choice or clearly documented region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code includes multiple hard-coded Korean user-facing strings in labels and hints, starting with the reason labels and continuing through summary and hint text. Because the file provides no mechanism for language selection or opt-in, it appears to enforce a specific locale, which matches the policy's language/locale violation criterion.

Content

No source excerpt is available for this finding.

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/price_alerts.py (reported line 180)May include surrounding context.

python

def run_search(script_name: str, params: list[str]) -> dict[str, Any]:
    command = [sys.executable, str(SCRIPT_DIR / script_name), *params]
    result = subprocess.run(command, capture_output=True, text=True, encoding="utf-8")
    if result.returncode != 0:
        raise RuntimeError(result.stdout or result.stderr or f"검색 스크립트 실패: {script_name}")
    try:

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This code presents command help, validation errors, diagnostic hints, and output text in Korean-language strings, such as the CLI description and argument help. Because the file does not provide any user opt-in or locale selection, it appears to force a specific language, which matches the language/locale policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This Python skill contains multiple hard-coded Korean descriptions and output strings, including the CLI description, argument help, errors, diagnostic hints, and human-readable summaries. Because the file does not provide any user opt-in or language-selection mechanism, it appears to impose a specific language/locale policy in a way that matches the natural-language policy violation criteria.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The file contains user-facing help and output strings in Korean, such as argument help text and status/headline messages, while the script description is in English and there is no indication that Korean output is optional or required for a region-specific compliance reason. This creates a language/locale policy concern because users are forced into a specific language without opt-in.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This Python file contains hard-coded Korean-language user-facing strings in the CLI description, examples, summary headline, and human-readable output. That enforces a specific language/locale for users without offering any language choice or documenting a justified locale restriction, which matches the policy-violation category for language or locale constraints.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 78% confidence

Finding

The file's headings, examples, and usage content are entirely in Korean, which can constitute a language/locale policy issue when a skill implicitly forces one language without user opt-in. There is no indication that the user can choose another language or that the Korean-only scope is explicitly justified as region-specific behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

This JSON fixture contains user-facing natural-language hint strings in Korean (e.g. "시간 조건 미충족" and "빠른 스캔 대비 상세 빈결과") with no indication that the skill offers a language choice or is intentionally limited to a Korean locale. Under the stated policy, fixed-language content without opt-in or justification is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

More diagnostic hint values are written only in Korean, including "시간 조건 미충족" and "usable match 없음", again suggesting the skill or its outputs may enforce a single locale. Because the file provides no opt-in, fallback language handling, or region-specific justification, this conflicts with the language/locale policy guidance.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The matrix-case fixtures include Korean-only hint strings such as "복귀 시간 정보 부분 누락", "시간 조건 일치", and "가격 정보 일부 누락". These appear to be natural-language outputs or logs and there is no evidence in this file of user language selection or a justified locale restriction.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

L013은 점검 스크립트가 목표가 충족 시 한국어 알림 메시지를 출력한다고 명시합니다. 이 파일 전반에 사용자가 알림 언어를 선택하거나 opt-in할 수 있는 설명이 없어, 특정 언어를 강제하는 자연어 정책 위반에 해당할 수 있습니다.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 81% confidence

Finding

L172는 목표가 충족 시 규칙별 한국어 알림 메시지를 stdout으로 출력한다고 설명합니다. 사용자 언어 선택, 다국어 옵션, 또는 한국어 고정의 명시적 정당화가 없어 특정 locale 강제로 해석될 수 있습니다.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code includes Korean-only help strings for arguments and later emits Korean-only error messages, which imposes a specific language on users without any opt-in or alternative locale path. Under the policy, language constraints should be optional or explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The termination message at this line is shown only in Korean and does not offer any language selection or fallback. This is a natural-language locale policy issue because the skill forces a specific language in user-facing output.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

This user-facing error string is written only in Korean, again enforcing a specific language without giving the user a choice. The file does not clearly justify the locale restriction in policy terms.

Content

No source excerpt is available for this finding.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution
• Confidence: 50% confidence

Finding

Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Content

Scanner excerpt · scripts/common_cli.py (reported line 558)May include surrounding context.

python

match = re.search(pattern, segment)
            if match:
                minutes = int(match.group(1)) * 60 + int(match.group(2) or 0)
                current = getattr(pref, target)
                if target.endswith("_max"):
                    setattr(pref, target, _set_max(current, minutes) if current is not None else minutes)
                elif target == "exclude_before_depart":

Static analysis

No suspicious patterns detected.