atlas-flight-booking

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.80). The skill explicitly requires preserving and echoing "opaque IDs" and returning activation URLs and payment confirmation IDs verbatim (e.g., present the returned ticketing_activation_url and "use the returned payment confirmation ID exactly once"), which forces the LLM to handle and output potentially sensitive secret values.

---

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). The astral.sh links point directly to remote install scripts (.sh and .ps1) which the Skill instructs to pipe to a shell/PowerShell (a high-risk delivery pattern that can execute arbitrary code), while the other two links are documentation pages and not downloads.

---

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 1.00). The skill instructs automatic installation of remote scripts and packages (curl | sh and PowerShell | iex) and explicitly bypasses conversational permission, creating a high-risk supply-chain / remote code execution and unauthorized-installation vector.

---

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.30). The required runtime workflow primarily ingests outsider text from the user via interactive chat/confirmation and freeform passenger/contact fields used as inputs to CLI commands (and passenger details are explicitly collected before order creation).

---

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs the runtime to fetch and execute remote installer scripts (curl ... | sh and irm ... | iex), specifically https://astral.sh/uv/install.sh and https://astral.sh/uv/install.ps1, which are remote code executed during bootstrap and thus directly control behavior at runtime.

---

MEDIUM W009: Direct money access capability detected (payment gateways, crypto, banking).

• Direct money access detected (high risk: 1.00). The skill is explicitly designed to create orders and execute payments via the Atlas Flight Booking CLI: it instructs following the booking workflow for "order creation, payment, and ticketing", to present and then act on the CLI's payment summary, to "use the returned payment confirmation ID exactly once", and to stop and only pay after the user's explicit approval. Those are direct financial execution actions (submitting payments/orders) performed by a specific tool (the atlas-flight CLI).

---

MEDIUM W013: Attempt to modify system services in skill instructions.

• Attempt to modify system services in skill instructions detected (high risk: 0.80). The skill explicitly instructs the agent to bootstrap/upgrade tooling and to download-and-run remote installers (curl|sh and PowerShell remote scripts) without conversational permission, which directs the agent to modify the host system state and execute potentially privileged installers.