ClawHub
Back to skill

Security audit

全球海岛选岛助手

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a legitimate island travel helper, but it needs Review because it instructs the agent to run a local CLI command using user-provided trip text without safe argument handling.

Install only if you are comfortable with a Chinese-language travel assistant that may use a locally configured Fliggy CLI after collecting trip preferences. Before using the product-link feature, prefer an exact pinned CLI version, avoid global installation where possible, and ensure any agent invokes the CLI with a structured argument array or validated inputs rather than a shell-interpolated command.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:7
Finding

Unpinned Globally Installed Third-Party CLI Dependency

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 7-12
Vulnerability Type: Supply-chain exposure through an unpinned global dependency
Risk Level: Medium

Vulnerable Code Snippet:

yaml
requirements:
  - name: flyai-cli
    version: "^1.0.0"
    description: "Optional dependency used to retrieve Fliggy product links"
    install: "npm install -g @fly-ai/flyai-cli"
    optional: true

Technical Analysis

The Skill recommends installing @fly-ai/flyai-cli globally while allowing any package version compatible with ^1.0.0. The project does not include a lockfile, integrity hash, verified package provenance, or other mechanism that ensures users install the same dependency version that was reviewed.

A global npm installation makes the package's executables available system-wide for the current environment. npm package installation may also execute lifecycle scripts unless explicitly disabled. Consequently, an unexpectedly changed or compromised compatible release could execute code during installation with the privileges of the user running npm.

The dependency is explicitly optional, and the Skill does not automatically retrieve and execute a remote payload. The risk arises when a user follows the documented installation instruction.

Attack Path

  1. An attacker compromises the package publisher, registry account, package distribution channel, or a future compatible release.
  2. The attacker publishes a malicious version satisfying the ^1.0.0 version range.
  3. A user follows the documented npm install -g instruction.
  4. npm resolves the compromised compatible release rather than a specifically reviewed version.
  5. Malicious package code or lifecycle scripts execute with the installing user's privileges.
  6. The globally installed executable remains available to subsequent invocations.

Impact Assessment

Successful exploitation could provide code execution with the pri ...[truncated 453 chars]

Remediation
View remediation

Remediation Suggestions

  1. Pin the dependency to an exact reviewed version rather than using a caret range.
  2. Record and verify the package's integrity hash and trusted registry source.
  3. Prefer a project-local installation governed by a committed lockfile instead of a global installation.
  4. Verify package provenance, publisher identity, release signatures, and repository ownership before recommending installation.
  5. Disable npm lifecycle scripts where the package can operate without them, or review every required lifecycle script.
  6. Run the CLI in a sandbox or least-privileged environment with access only to resources needed for product searches.
  7. Document a safe upgrade and re-audit process so new versions are reviewed before the pin is changed.

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:168
Finding

User-Controlled Travel Data Interpolated into a Shell Command

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 168-175
Vulnerability Type: Potential OS command injection through unsafe shell interpolation
Risk Level: High

Vulnerable Code Snippet:

bash
flyai fliggy-fast-search --query "{destination} {number_of_days} days {requirement_keywords}"

The placeholders above correspond to the destination, trip duration, and activity or requirement keywords collected from the conversation.

Technical Analysis

The documented command combines conversation-derived values into a command string intended for shell execution. The Skill does not require strict input validation, shell escaping, character filtering, or invocation through a structured argument-array API.

Quoting the combined query with double quotes is not sufficient protection if an attacker-controlled value can contain a double quote, command substitution, or other shell metacharacters. A crafted value could terminate the intended argument and introduce additional shell syntax when an agent passes the resulting string to a shell such as bash.

For example, the logical payload pattern is:

text
destination = value"; attacker_command; #

After unsafe interpolation, the quote can be terminated and attacker_command can be interpreted by the shell. Actual exploitability depends on whether the hosting agent executes the documented command through a shell or invokes the executable with a safely constructed argument array.

Attack Path

  1. The Skill asks the user for destination, duration, or activity requirements.
  2. An attacker supplies a value containing quote termination and shell-control syntax.
  3. The agent stores the value as part of the recommendation workflow.
  4. After the five-step process, the agent interpolates the value into the documented flyai fliggy-fast-search command.
  5. The agent submits the resulting command string to a shell without robust escaping.
  6. The shel ...[truncated 799 chars]
Remediation
View remediation

Remediation Suggestions

  1. Do not construct a shell command by concatenating or interpolating conversational input.
  2. Invoke the CLI directly through a process API that accepts a structured argument array, for example an executable name plus ["fliggy-fast-search", "--query", query], with shell processing disabled.
  3. Validate trip duration as a bounded integer and normalize it before use.
  4. Resolve destinations against an explicit allowlist from the island database rather than accepting arbitrary command text.
  5. Restrict requirement keywords to an enumerated set of supported activities.
  6. Reject control characters, newlines, null bytes, and unexpected shell metacharacters as defense in depth.
  7. Apply an execution timeout, minimal environment, restricted working directory, and least-privileged sandbox to the CLI process.
  8. Add automated tests covering embedded quotes, command substitutions, semicolons, newlines, and other argument-boundary attacks.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The trigger list is broad enough to match generic travel conversation such as '想去海边' or '海边度假', which can cause the skill to activate outside a clear island-selection intent. Over-broad activation can hijack unrelated user flows, collect unnecessary preference data, and increase the chance that external API calls are made in contexts the user did not explicitly request.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill content assumes Chinese-only interaction and does not provide a language negotiation or fallback path. While not a classic security bug, this can mis-handle user intent, cause confusing data collection prompts, and reduce informed consent around privacy and external API use for non-Chinese-speaking users.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

This markdown file presents all user-facing content in Chinese, starting with the title and continuing throughout, with no indication that users may choose another language. Under the language/locale policy, forcing a specific language without user opt-in is a natural-language policy violation unless the constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.