Security audit

lunar-new-year-flight

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not malicious, but it should be reviewed because it tells agents to install and run a global third-party CLI automatically.

Install only if you trust the FlyAI CLI and are comfortable approving its installation and execution. Require explicit confirmation before any npm install or booking-link workflow, and prefer a version that narrows activation to flight-search requests and documents every CLI flag it uses.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (10)

Intent-Code Divergence

Medium

Confidence: 89% confidence
Finding: The skill explicitly tells the agent that only documented flags may be used, but later instructs use of `--journey-type 1`, which is not present in the parameter table. This inconsistency can cause the agent to rely on hidden or undocumented behavior, making command execution less predictable and weakening safeguards intended to constrain CLI usage.

Vague Triggers

Medium

Confidence: 81% confidence
Finding: Including the generic trigger phrase `book a flight` makes this skill activate for broad flight-booking requests, not just Lunar New Year or Spring Festival scenarios. That can route unrelated user requests into this skill's install-and-execute workflow, increasing the chance of unnecessary command execution and unintended tool use.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install `@fly-ai/flyai-cli` globally if missing, but provides no user-facing warning or confirmation step before modifying the system. This is dangerous because it normalizes package installation and execution as part of ordinary query handling, potentially changing the host environment without explicit consent.

Missing User Warnings

Low

Confidence: 92% confidence
Finding: The file instructs the operator to run a global npm install command, which modifies the host environment and can execute package installation scripts, but it does so without any warning or safer alternative. In an agent skill context, this is risky because it normalizes making persistent system changes during failure recovery, increasing the chance of unintended environment modification or supply-chain exposure.

Missing User Warnings

Low

Confidence: 93% confidence
Finding: This repeated fallback again directs a global npm install with no warning about persistence, privilege implications, or package-install side effects. Repetition in a troubleshooting section makes the behavior more likely to be followed automatically, which raises operational risk even if the intent is simply to help the user recover.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger words for the Cheapest Option playbook are very broad and context-free, so ordinary user language like 'cheap' or 'budget' could activate this flow even when the user did not explicitly ask to prioritize lowest price. In a travel-booking skill, this can cause the agent to return misaligned results or steer users toward undesired itineraries, especially when price conflicts with convenience, baggage rules, or timing.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: Terms like 'fast' and 'quick' are ambiguous in natural language and may refer to booking speed, response speed, or urgency rather than shortest travel time. This can incorrectly invoke the Fastest Route playbook and return itineraries that optimize duration at the expense of cost or other user preferences.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: Trigger terms like 'direct' and 'nonstop' are common but still underspecified without confirming that the user wants routing constraints rather than general travel advice. In this skill, misrouting to a direct-flight-only search can exclude valid options and produce incomplete or misleading booking recommendations.

Vague Triggers

Medium

Confidence: 92% confidence
Finding: The fallback condition '0 results from above playbooks' is not operationally defined, which can lead to inconsistent or unexpected fallback activation. Because the fallback broadens behavior by adding a keyword search, it may produce less precise results, trigger unreviewed search paths, or create confusing agent behavior when initial searches fail for transient or parameter-related reasons.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The workflow mandates checking for a CLI, globally installing it if absent, and then executing it to answer the request, all before establishing trust boundaries or confirming user intent. In agent contexts, this creates a dangerous pattern where external code acquisition and execution are normalized, increasing supply-chain, environment-modification, and arbitrary-command risks.

Static analysis

No suspicious patterns detected.