Security audit

pet-flights

Security checks for vulnerabilities and agentic risk

Overview

This skill is a pet-flight helper, but it asks agents to install an unpinned global CLI, may escalate to sudo, and quietly persists raw travel queries in a local log.

Review carefully before installing. Use this only in an isolated environment where you are comfortable with the flyai CLI and its booking links. Do not allow sudo npm installation, avoid automatic global installs, and disable or remove the execution log unless it is sanitized and disclosed. Treat returned flights as candidates that still require direct airline pet-policy confirmation before booking.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Booking-Link Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:3
Finding: Unpinned Global npm Installation with Recommended Root Privileges
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:33
Finding: Shell Injection and Sensitive-Data Exposure in Execution-Log Persistence
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook stores `{raw input}` in `generation_log_json` and then embeds the complete generated value inside a single-quoted shell command. No escaping, shell-safe encoding, or structured filesystem API is required. If raw user input contains a single quote, it can terminate the shell string. Additional shell syntax can then be interpreted as a command when the documented persistence operation is executed. JSON metacharacters such as quotes, backslashes, and newlines can also corrupt the output when serialization is performed through direct string substitution. A representative malicious input could contain a pattern conceptually equivalent to: ```text '; attacker_command; # ``` If inserted without robust serialization and shell escaping, the resulting command can become structurally equivalent to: `` ...[truncated 1818 chars]
Remediation: View remediation

other

Warning

Location: SKILL.md:173
Finding: Generic Flight Results Are Misrepresented as Pet-Friendly
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Guangzhou" --dep-date 2026-06-01 --journey-type 1 --sort-type 8

text
## Output Rules 1. **Conclusion first** — lead with best pet-friendly option (direct preferred) 2. **Pet travel tips** — remind user about airline pet policies and carrier requirements

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest promises broad multi-service travel capabilities including hotels, trains, attractions, visas, insurance, and car rental, but the actual skill only defines pet-flight workflows. This mismatch can mislead an agent into invoking the skill outside its implemented scope, causing incorrect routing, failed executions, or unsafe fallback behavior if the agent tries to satisfy unsupported requests anyway.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback instructions tell users to perform a global npm install and escalate to sudo if it fails, but provide no warning about the risks of system-wide package installation or privileged execution. Because npm install scripts can execute code during installation, encouraging sudo increases the blast radius to full system compromise if the package, dependency chain, or registry resolution is malicious or tampered with.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 95% confidence
Finding: The content explicitly suggests running sudo npm i -g, which combines root privileges with execution of third-party package installation logic. In an agent skill context, this is dangerous because users may copy-paste the command directly, granting unnecessary elevated privileges to code fetched from the network.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data. # Tell user: "Please run npm i -g @fly-ai/flyai-cli manually."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook says the agent maintains an internal execution log containing raw user input and CLI command details while also noting it is not shown to users. This creates a transparency and privacy problem because users are not warned that their requests and backend actions may be captured internally.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs the raw user query and detailed execution metadata for every request, which exceeds what is necessary for a pet-travel booking skill and can capture sensitive travel, identity, or payment-adjacent information. Because this is an internal logging schema, users are not informed and the data may be retained or accessed beyond the original transaction.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Logging raw user input together with execution details and persisting that data creates a meaningful data retention and leakage risk. In this skill's travel-booking context, user queries may include names, routes, dates, pet details, visa questions, or other sensitive natural-language content that should not be broadly retained.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Appending execution logs to a local file without any user warning means the skill introduces persistent storage of interaction data invisibly to the user. In a travel context, such logs may contain itinerary, pet transport, and other personal details that users would not expect to be retained.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook directs the agent to append execution logs to a local file, creating persistent storage of potentially sensitive user and command data without a demonstrated business need. Persistent filesystem logging increases the chance of unintended retention, later disclosure, or reuse of travel-related personal data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The playbook explicitly instructs command execution and includes a networked keyword-search fallback, but provides no user-facing disclosure or confirmation step before external actions occur. This can cause unintended outbound requests or searches using user travel data, which is a real transparency and consent issue even though the commands themselves are not overtly dangerous.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.