Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed offline Schengen-day calculator that stores travel entries locally, with one correctness bug to consider but no evidence of malicious behavior.
Before relying on this for travel decisions, treat it as an offline arithmetic aid rather than legal advice, verify dates against official guidance, and be cautious with the traps command because planned future stays may be flagged too conservatively.
The skill appears to rely on reading and writing a local schengen.json file, but it does not explicitly declare any tool scope or permissions. That creates an authorization ambiguity: an agent platform may grant broader file capabilities than users expect, making local file access less transparent and harder to constrain or audit.
This is a true logic flaw: in the 'planned future stays' scan, the loop iterates over future stays already present in stays and then calls audit(stays, we, extra_stay=s), which adds that same stay a second time. That inflates calculated usage and can incorrectly label a lawful future trip as '[THIN MARGIN]' or '[OVER CAP]'. In this travel-compliance context, false overstay warnings can mislead users into canceling, shortening, or rescheduling legitimate travel plans based on incorrect legal-risk calculations.
The description says to use the skill when the user travels or plans travel to Europe on a non-EU passport and must respect the Schengen 90/180 rule, but it does not define concrete trigger phrases or clear exclusion examples beyond a few unsupported cases. In a manifest/markdown context, this broad activation wording could cause the skill to be invoked for general Europe travel questions that are not specifically asking for Schengen-day calculations.
No suspicious patterns detected.
