Security audit
Security checks for vulnerabilities and agentic risk
This skill is a disclosed RollingGo flight-search integration with no local execution, persistence, or booking/payment authority.
Install only if you are comfortable sending flight-search details to RollingGo's remote service; treat returned prices and availability as informational until confirmed with the airline or booking provider.
The description advertises activation on generic phrases such as "find flights," "cheap flights," and "flight price." While travel-related, these are still broad natural-language requests and the manifest line does not provide tighter invocation constraints beyond the general topic, which can increase unintended auto-invocation risk.
The reference states that a public RollingGo MCP endpoint can be used without client-side authentication, but it does not warn that user-entered travel data will be sent to a third-party external service. In a flight-search skill, queries commonly contain itinerary, location, and timing details that may be privacy-sensitive; lack of disclosure can lead to unintentional data sharing and weak consent boundaries.
The document uses Chinese-only example inputs like 杭州 and response strings like 机场搜索成功, but it does not explicitly state that the skill is intended only for Chinese-language usage or offer users a language/locale option. Under SQP-3, forcing or assuming a specific language without opt-in can be a natural-language policy issue.
No suspicious patterns detected.
