Security audit

Global Travel Planner Public

Security checks across malware telemetry and agentic risk

Overview

This skill is a coherent travel-planning helper that generates bilingual Word reports and does not show hidden data access, credential use, persistence, or destructive behavior.

Install only if you are comfortable with a travel skill that may use your destination query for live web lookups in chat mode and may infer output language from the text you type. Verify visa, legal, safety, and consular details with official sources before relying on the generated report.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Natural-Language Policy Violations

Medium

Confidence: 86% confidence
Finding: The skill states that it will automatically infer the user's language/nationality context and choose output language without explicit user opt-in. This can cause incorrect assumptions about the user and may lead to unwanted processing of sensitive inferred attributes, especially when nationality or preferred language is treated as automatically derivable from the prompt.

Missing User Warnings

Low

Confidence: 78% confidence
Finding: The skill mentions that supplemental data is fetched live from the web on each query, but this disclosure appears buried in feature text rather than presented as a clear user warning before use. Users may not realize that every request triggers external retrieval, which has privacy, transparency, and data-trust implications.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.