Security audit

travel-planner

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill behaves as described, but generated itineraries may load third-party maps, CDN scripts, and booking sites.

Before installing, be aware that generated itinerary HTML can contact third-party CDNs, map tile providers, Xiaohongshu, and booking platforms when opened or clicked. Avoid putting highly sensitive trip details into shared itinerary files, verify booking domains before payment, and check the output path to avoid overwriting files.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The template loads executable JavaScript and CSS from third-party CDNs and also fetches map tiles from multiple remote providers at runtime. Even with SRI on Leaflet assets, this creates a supply-chain and privacy exposure: opening the generated HTML causes network requests, remote code execution in the browser context, and disclosure of user IP/usage metadata to external services.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The skill explicitly instructs saving generated HTML files to `workspace/output/` or a user-specified directory, but it does not require notifying the user or obtaining confirmation before writing to disk. This can lead to unexpected file creation, accidental overwrites, or writing sensitive itinerary data to locations the user did not intend, especially in agentic environments where file operations may happen automatically.

Missing User Warnings

Low

Confidence: 87% confidence
Finding: The README advertises booking links, reference links, CDN dependencies, and third-party map services without telling users that opening the generated itinerary may contact external services and expose metadata such as IP address, user agent, timing, and possibly travel interests. In a travel-planning context, those disclosures matter because the generated content is likely to contain sensitive itinerary details and destination preferences, making silent third-party network access a real privacy concern even if the technical impact is limited.

Missing User Warnings

Low

Confidence: 85% confidence
Finding: The skill promises that all booking links will be clickable, but it does not warn users that those links lead to external sites that may collect personal data, use tracking, or expose users to spoofed booking pages if link generation is not tightly controlled. In a travel-planning context, this is more relevant than in many other skills because users are likely to click through to third-party booking platforms and may enter payment or identity information.

Static analysis

No suspicious patterns detected.