Airline Info To Website

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:25 AM UTC
• Version: 0.1.1

Overview

The skill is an airline seat-map scraping and image-organizing tool, but it asks users to bypass agent permissions and persist broad shell/write privileges that are not necessary for the task.

Review this skill carefully before installing. Do not run it with permission bypass or add the suggested broad ~/.claude/settings.json permissions. If used, run it only in a constrained project directory, use dry-run modes first, back up downloaded data before deduplication, and restrict scraping to trusted seatmaps.com URLs.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:31

Finding

Skill Instructions Disable Agent Permission Controls

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scrape_seatmaps.py:298

Finding

Unrestricted URL Fetching Enables Server-Side Request Forgery

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: README.md:13

Finding

Unpinned Third-Party Python Dependencies

Content

View full analysis

Remediation

View remediation

` - `beautifulsoup4==` 2. Pin all transitive dependencies through a generated lock file. 3. Use hash verification, such as `pip install --require-hashes -r requirements.txt`. 4. Generate and review locks with a tool such as `pip-tools`, Poetry, or another reproducible dependency manager. 5. Install dependencies inside a dedicated virtual environment rather than the global Python environment. 6. Configure a trusted package index explicitly where appropriate. 7. Add automated vulnerability and dependency-update scanning. 8. Review and regenerate the lock file intentionally when upgrading rather than resolving mutable latest versions during normal use. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (27)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

声明描述的是一个较完整的数据抓取与内容生成流程，核心包括从 seatmaps.com 获取航空公司机型座位图及相关信息、处理机型详情/舱位配置/座椅图片/机上设施，并生成网站展示信息。但该代码块仅是离线后处理工具，不进行网络访问，不抓取任何网页或 API，也不解析 seatmaps.com 数据。它只读取本地目录中的图片文件，根据文件名关键词进行分类复制，并生成分类统计报告。因此，代码行为只覆盖了声明中“自动分类整理图片”的一小部分，且缺失了声明的主要能力，属于明显的描述与实际行为不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

声明描述的是一个面向航空公司/机型座位图数据采集与整理的技能，核心能力应包括抓取外部数据源、解析座位图与机上设施信息、整理并生成网站展示内容。而实际代码完全没有网络访问、抓取逻辑、HTML/API 解析或站点内容生成功能。相反，它只对本地目录中的图片文件进行哈希比对，识别并删除重复项，并输出去重报告。删除文件属于具备副作用的重要能力，但在声明中未体现。因此该代码块与声明用途存在明显且实质性的不匹配。

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

该代码的核心行为与“抓取 seatmaps.com 内容并保存本地资料”基本相关，但描述明显夸大了自动化处理能力。代码确实支持 seatmaps.com 数据源、按航司发现机型链接、抓取机型页面、下载图片、保存原始页面，并生成整理文档；这些部分与声明部分一致。但声明中的关键能力——自动分类图片、自动处理机型详情/舱位配置/座椅图片/机上设施信息、以及生成可用于网站展示的航司信息——在代码中并未真正实现。生成的“机型详情.md”主要是固定模板，许多核心字段都是“待确认/待补充”；图片也没有按座位图、餐食、娱乐设备等目录进行分类，只统一下载到原始数据目录。因此这是描述与实际行为不一致的情况，属于能力被显著高估。

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly instructs users to run with bypassed permissions and broad write/edit access, removing an important safety barrier before the user has validated what the skill will do. In the context of a skill that performs filesystem writes, deletion, and network retrieval, this greatly increases the blast radius of any bug, malicious modification, or unexpected behavior.

Content

No source excerpt is available for this finding.

Agent Config Directory Access

High

• Category: Agent Snooping
• Confidence: 97% confidence

Finding

The skill directs the user to modify ~/.claude/settings.json, an agent configuration path, to grant broad permissions including Bash, Edit, Write, and MultiEdit. Encouraging persistent expansion of agent privileges at the config level is dangerous because it outlives this task and can expose future sessions to unintended filesystem modification or execution risk.

Content

Scanner excerpt · SKILL.md (reported line 34)May include surrounding context.

claude --dangerously-skip-permissions --permission-mode bypassPermissions

text

或配置 `~/.claude/settings.json`：

```json
{

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 59)May include surrounding context.

md

| 5 | 语义分类 | `node scripts/classify-images.js --base-dir "FlightData/航司目录"` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 81)May include surrounding context.

md

| 5 | 语义分类 | `node scripts/classify-images.js --base-dir "FlightData/航司目录"` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

| 6 | 去重 | `node scripts/dedup-images.js --base-dir "FlightData/航司目录"` |

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 84)May include surrounding context.

md

| 6 | 去重 | `node scripts/dedup-images.js --base-dir "FlightData/航司目录"` |

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises automatic deletion of duplicate images but does not warn users that the operation is destructive or potentially irreversible. In a data-collection workflow, mistaken duplicate detection or user misunderstanding can cause unintended loss of scraped assets and reduce reproducibility of the dataset.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The quick-start sequence instructs users to run the deduplication command directly, without any caution that it may remove files. Because users commonly copy-paste setup steps, this increases the chance of accidental destructive actions before they understand the tool's behavior or verify output paths.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The natural-language content of the skill, including its description, execution phases, and usage guidance, is presented in Chinese only. This imposes a language constraint on users without opt-in or explanation, which fits the policy category for forced language/locale behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The manual is written in Chinese and includes a zh-CN example URL, but it does not indicate that Chinese is optional or required for a region-specific purpose. Per the policy, skills should not impose a language or locale without user opt-in or documented justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The file forces a specific language/locale in its natural-language instructions and headings, and there is no indication that the user can opt into another language. The stated policy requires flagging language or locale constraints unless a choice or clear justification is provided.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file documents a script that deletes files permanently based on MD5 duplicate detection, but it does not include a clear user warning about destructive or irreversible effects. Although --dry-run is mentioned, the default example still shows the destructive command without an explicit caution to back up data or review results first.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The manifest describes collecting seat map data, classifying images, and generating airline information for website presentation. This utility performs destructive local cleanup by deleting duplicate images and also creates a separate report file, which are maintenance operations not described in the stated skill behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This code file contains natural-language strings and usage text entirely in Chinese, and later generates Chinese-only markdown content and filenames. The policy requires flagging language or locale constraints when the skill forces a specific language without user opt-in, and no option or justification is provided here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The manifest says the skill will automatically classify seat maps, seat photos, and onboard facility images for website presentation. In the implementation, images are only saved under images/0-原始数据, and no logic exists to sort them into the category folders described by the skill's purpose.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The markdown generated by create_detail_doc asserts that images are stored in categorized folders such as 1-座椅布局/ and 2-座椅图片/. However, elsewhere the scraper only creates images/0-原始数据 and downloads every image there, so the documentation actively misrepresents the actual behavior.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

Natural-language policy issues apply to all file types, including markdown. This README presents the operational documentation only in Chinese and does not indicate that the skill is region-specific or offer an opt-in language choice, which can amount to a forced language constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 79% confidence

Finding

This markdown file provides commands that scrape site content and save results under FlightData/, and the output tree confirms multiple generated files and image directories. The examples describe how to run the commands but do not warn users that the skill will download remote content and create substantial local filesystem output.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The reference file instructs the agent to run scraping commands and generate or update local files, but it does not warn about external network access, downloading untrusted content, or filesystem modifications. In an agent setting, this can cause unintended outbound requests and writes without explicit user awareness or confirmation, increasing the risk of overbroad automation and unsafe handling of remote data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This markdown template hard-codes Chinese headings, labels, and notes throughout the file. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is explicitly documented and justified, which is not present here.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The documentation is entirely in Chinese and does not indicate whether other languages are supported or whether the Chinese-only presentation is intentional for a region-specific audience. Under the policy, forcing a specific language without user opt-in can be a natural-language policy violation unless the locale constraint is clearly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.