Security audit

may-day-travel-guide（五一旅游攻略）

Security checks for vulnerabilities and agentic risk

Overview

This is a Markdown-only Chinese May Day travel planning guide with no code execution, persistence, credential handling, or hidden system changes.

Installers should understand this skill is aimed at Chinese-speaking users planning China domestic May Day trips. Its activation metadata is broad, so it may trigger on many May Day travel questions, but the package itself is static guidance content without privileged behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

Category: YARA Match
Content: --- name: may-day-travel-guide description: 五一假期旅游攻略 - 专门为中国五一假期设计的旅游指南，聚焦国内热门目的地、避坑攻略、行程规划、预订建议。五一旅游、劳动节旅游、五一去哪玩、五一攻略、五一出行、五一国内游、五一短途游、五一自驾游、五一亲子游、五一度假、五一赏花游、五一避坑指南、五一预订攻略、五一行程规划、五一旅游推荐、2026五一旅游、五一黄金周、五一假期安排、五一旅游计划、五一热门景点、五一人少景美、五一冷门景点、五一美食旅游、�
Confidence: 80% confidence
Finding: YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The manifest description contains a very large set of broad travel-related trigger phrases, which can cause the skill to activate on many generic travel requests beyond its intended May Day scope. Over-broad routing can hijack user intent, degrade least-privilege behavior, and increase the chance that users receive irrelevant or biased guidance when another skill would be more appropriate.

Natural-Language Policy Violations

Medium

Confidence: 88% confidence
Finding: The skill is written entirely in Chinese and implicitly assumes Chinese-localized behavior without stating how language should be selected or how non-Chinese users are handled. This can cause unintended activation or unusable outputs for users in other languages, which is a routing and reliability weakness rather than a direct exploit primitive.

Natural-Language Policy Violations

Low

Confidence: 90% confidence
Finding: SQP-3 applies to all file types and covers language or locale policy violations. This travel guide presents all instructions and recommendations only in Chinese, with no opt-in, alternative language, or explanation that the skill is intentionally region- or language-specific.

Static analysis

No suspicious patterns detected.