Security audit

Travel.Skills

Security checks for vulnerabilities and agentic risk

Overview

This is a travel-planning prompt skill with no executable code, no required credentials, and only expected informational search/map use.

Before installing, treat this as an informational travel planner. It may rely on live search or map tools and may ask for trip dates, destination, ages, mobility needs, and budget. It should not make bookings or payments for you; verify prices, accessibility, and ticket rules with official providers.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This markdown file contains user-facing instructions and examples only in Chinese, while L77 states the skill supports both Chinese and English. Under the policy, forcing or effectively defaulting to a specific language without user opt-in is a natural-language policy concern.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger includes generic phrases like "traffic" and "offbeat destinations," which commonly appear in ordinary travel conversations and do not clearly distinguish when this specific module should activate. The file also does not provide exclusion conditions or negative examples to limit unintended invocation.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The prompt defines the assistant role and behavior entirely in Chinese, which effectively constrains interaction language without indicating that the user may choose another language. This is a natural-language policy concern because it imposes a locale/language expectation rather than offering an explicit user opt-in.

Intent-Code Divergence

Medium

Confidence: 88% confidence
Finding: The prompt labels capability 3 as a ticket/hotel booking assistant, yet explicitly says '不直接代订，仅提供信息' ('does not directly book, only provides information'). Given the manifest also advertises 'booking integration,' this documentation creates conflicting expectations about whether the skill performs bookings or merely informs users about booking channels.

Static analysis

No suspicious patterns detected.