Security audit

loyalty-flight

Security checks for vulnerabilities and agentic risk

Overview

This looks like a real travel-search helper, but it tells agents to globally install and run a third-party CLI without a clear approval or privacy step.

Install only if you are comfortable with a third-party travel CLI being added globally and with your flight or trip details being sent to that service. Prefer manually reviewing/installing the CLI, using a pinned version if available, and confirming each search before the agent runs external queries or opens booking links.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill explicitly states that only parameters listed in the Parameters Table may be used, yet the direct-flight playbook introduces an undocumented `--journey-type` flag. This inconsistency can cause an agent to rely on unverified CLI behavior, increasing the risk of command misuse, runtime failure, or unsafe parameter expansion if the CLI accepts unexpected flags.

Intent-Code Divergence

Low

Confidence: 91% confidence
Finding: The output template brands results as powered by "flyai" even though the skill metadata says the service is backed by Fliggy. This inconsistency can mislead users about the service provider, reduce trust, and create phishing or impersonation risk if users are trained to click provider links under the wrong brand.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The activation trigger includes the broad Chinese phrase `订机票` ('book flight'), which overlaps with ordinary travel requests outside the stated loyalty/award-flight scope. This can cause the skill to activate on unrelated prompts and steer the agent into unnecessary CLI execution, external queries, and behavior outside user intent.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill directs the agent to install a global npm package (`npm i -g @fly-ai/flyai-cli`) and execute it automatically if missing, without requiring user consent or warning about system modification. Automatic package installation is dangerous because it changes the host environment, introduces supply-chain risk, and may execute untrusted post-install scripts.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill mandates live CLI queries to an external travel service but does not warn the user that their itinerary data may be sent over the network to a third party. This is risky because travel searches can contain sensitive personal or business information, and silent transmission undermines informed consent and privacy expectations.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The file instructs the agent/operator to run a global npm install command that modifies the host environment without any warning, consent step, or safer alternative. In an agent setting, environment-changing commands increase supply-chain and system-integrity risk because they can install unpinned code globally and affect future executions beyond this task.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: This repeated fallback again directs a global npm install with no warning that it changes the system environment. Repetition makes the behavior more likely to be followed automatically by an agent or user, increasing the chance of unnecessary privileged changes and exposure to package-repository or dependency compromise.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases for the fastest-route playbook include very generic terms like "fast" and "quick", which can match unrelated travel or non-travel requests and invoke this workflow unintentionally. In an agent setting, underspecified triggers can cause the wrong tool action to run, leading to incorrect booking/search behavior or unnecessary external queries.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The direct-flight playbook uses ambiguous terms like "direct" and "nonstop" without requiring explicit flight context, which can cause unintended invocation from unrelated conversation turns. This is risky because the agent may execute a search with user-supplied parameters in the wrong context, producing misleading results or triggering unnecessary third-party actions.

Vague Triggers

Low

Confidence: 78% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and does not clearly define precedence, retry limits, or when broad keyword search is safe to invoke. That can lead to over-broad activation and unnecessary expansion from structured flight search into generic keyword search, increasing the chance of irrelevant external queries and unintended behavior.

Static analysis

No suspicious patterns detected.