Security audit

luggage-shipping

Security checks for vulnerabilities and agentic risk

Overview

This is a real flight-search skill, but it tells agents to install and run an unpinned global npm CLI before answering, so users should review it carefully before use.

Install only if you are comfortable with the agent installing and running a global npm package for flight searches. Prefer requiring manual approval for package installation, using a reviewed pinned version of `@fly-ai/flyai-cli`, and limiting the personal travel details you provide because route, date, and budget information may be sent to the external flyai/Fliggy service.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill explicitly says agents must never invent CLI parameters and may only use flags from the documented parameter table, yet a later playbook uses `--journey-type 1`, which is undocumented. This inconsistency can cause agents to rely on hidden or unreviewed command behavior, undermining safe parameter governance and making it easier for unsafe flags to be smuggled into execution workflows.

Vague Triggers

Medium

Confidence: 95% confidence
Finding: The metadata description claims support for many unrelated travel functions beyond luggage-shipping, which broadens the apparent scope of when this skill may be selected. Over-broad scope increases the chance the agent invokes this skill for unrelated user requests, causing unnecessary command execution and exposing users to actions not justified by the request.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The trigger list includes generic phrases such as Chinese `出行预订` ('travel booking'), which overlap with ordinary travel requests far outside luggage shipping. This increases accidental activation, making the agent more likely to run the CLI or installation workflow in situations where the user never requested this specialized skill.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs the agent to install `flyai-cli` if it is missing, which is a system-modifying action that goes beyond answering a user travel query. Performing global package installation without explicit user consent creates supply-chain and environment-integrity risk, especially because package installation executes code fetched from a remote registry.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The fallback path performs `npm i -g @fly-ai/flyai-cli` and then immediately executes the installed binary, creating a chained remote-code-execution path through a global package install. Because no warning, pinning, or trust verification is provided, an agent following this workflow could modify the host system and run untrusted code under ordinary task fulfillment.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger terms for the cheapest-flight playbook include very broad words like "cheap" and "budget," which can appear in many travel requests that are not specifically asking for the lowest-cost flight. This can cause the agent to route users into an unintended workflow and prioritize price over other important constraints such as baggage/shipping, timing, or directness, producing incorrect or misleading travel recommendations.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The fastest-route playbook is activated by generic terms like "fast" and "quick," which are ambiguous in travel conversations and may refer to booking speed, response speed, or general convenience rather than shortest flight duration. This ambiguity can misroute requests and cause the system to ignore the user's actual needs, including luggage-shipping requirements central to this skill.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The fallback condition of "0 results from above playbooks" is underspecified because it does not define evaluation order, tie-breaking, or guardrails for when the broad keyword search should run. In practice, this can trigger overly broad searches that return irrelevant results, bypass the intended luggage-shipping focus, and reduce reliability or safety of downstream recommendations.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The workflow normalizes escalating from a user query to environment inspection and then to global package installation before providing an answer. This creates a fail-open operational pattern where routine requests can trigger host-level changes, increasing the chance of unsafe execution and making risky actions seem mandatory rather than exceptional.

Static analysis

No suspicious patterns detected.