Flyai / bargain-flights / lowprice / flights / hidden-city / ticketing / search / 捡漏机票 / 聪明买法 / 低价机票

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:33 AM UTC
• Version: 1.0.8

Overview

The skill mostly matches its flight-deal purpose, but it needs review because it installs an unpinned global CLI and automatically exposes booking links to a third-party QR service.

Install only if you are comfortable with a global unpinned npm CLI and with booking links being shared with api.qrserver.com when QR links are opened or previewed. Prefer an isolated environment, pin and review the CLI version, avoid sensitive or signed booking URLs, and independently verify airline policy, baggage, visa, and ticketing risks before buying hidden-city fares.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:26

Finding

Unpinned Third-Party CLI Installed Globally

Content

View full analysis

Remediation

View remediation

``` 2. Maintain a lockfile and verify the resolved package integrity before installation. 3. Avoid global installation. Install the CLI in a dedicated project directory or isolated container. 4. Where compatible, disable lifecycle scripts during installation: ```bash npm install --ignore-scripts ``` 5. Review any required lifecycle scripts separately before enabling them. 6. Run the CLI under a dedicated, minimally privileged account with restricted filesystem and network access. 7. Use an internal registry mirror or allowlist that serves only reviewed package versions. 8. Document the reviewed package version and repeat the security review before upgrading it. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/qrcode.py:25

Finding

Booking URLs Disclosed to a Third-Party QR Service

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill is framed as a flight-analysis assistant but also processes arbitrary URLs to generate third-party QR-code links. That extends the skill into generic link transformation and external transmission unrelated to its stated purpose, which can expose booking links or other attacker-supplied URLs to a third party and make phishing or tracking easier under the cover of a travel skill.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence

Finding

The skill is framed as a flight-analysis assistant but also processes arbitrary URLs to generate third-party QR-code links. That extends the skill into generic link transformation and external transmission unrelated to its stated purpose, which can expose booking links or other attacker-supplied URLs to a third party and make phishing or tracking easier under the cover of a travel skill.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

md

默认续程城市配置见 `data/drop_routes.json`，用户可自定义。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 267)May include surrounding context.

md

默认续程城市配置见 `data/drop_routes.json`，用户可自定义。

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 287)May include surrounding context.

md

默认续程城市配置见 `data/drop_routes.json`，用户可自定义。

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This markdown file contains user-facing instructions only in Chinese, and there is no indication that the skill is limited to a Chinese-speaking audience or that alternative language support is available. That can violate a language/locale policy when users are not given an opt-in or choice.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill declares network access and relies on local scripts/configuration, but it does not define an explicit tool or permission scope. That makes the effective capability boundary ambiguous and increases the chance that an agent executes broader file-read or network actions than users expect. In an agent ecosystem, missing least-privilege declarations are a real security weakness because they reduce enforceability and auditability.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger conditions are broad enough that the skill may activate for generic flight-saving or travel discussions. Overbroad invocation matters here because the skill performs external lookups and third-party URL generation; unintended activation can cause unnecessary data disclosure, off-topic network access, or user steering into risky hidden-city-ticketing workflows without clear intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

文件整体描述和用户沟通话术均以中文固定呈现，且未说明可根据用户偏好切换语言或先征求语言选择。对于面向广泛用户的技能，这构成了语言/locale 约束未获用户选择的自然语言政策问题。

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The security note says the skill does not read local files, yet the later instructions explicitly require reading a local configuration file. False security claims are dangerous because they can cause reviewers and users to underestimate data exposure or file-access behavior, especially in agent systems where local file reads may be sensitive.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The skill sends URLs to an external QR-code service, which is a real data transmission to a third party outside the primary flight provider. Even if the URL is only a booking link, it may contain identifiers, tracking parameters, or sensitive itinerary details; if the input is attacker-controlled, this feature can also be abused to wrap arbitrary links in trusted-looking output.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

python3 scripts/qrcode.py --url "{jumpUrl}"

text

输出示例:`https://api.qrserver.com/v1/create-qr-code/?size=300x300&data=...`

**展示方式**:在 markdown 中直接提供一个可点击的链接,点击后跳转打开二维码图片:

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

L404 声称“只需要目的地城市所在国家的签证”，但该技能的核心行为是推荐 A→B→C 的隐藏城市联程票，实际购票与乘机涉及最终票面终点 C，且文档前文也说明存在国际路线判断与签证提醒。对于隐藏城市票，宣称只需 B 的签证与技能自身场景并不一致，可能误导用户低估跨境合规要求。

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The skill file is written entirely in Chinese and repeatedly specifies output formatting requirements in Chinese, but does not indicate that other languages are supported or that the user may choose a language. Under the policy rule for natural-language violations, forcing a specific language without opt-in is a reportable issue unless the locale restriction is explicitly justified.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The module docstring, usage instructions, and later user-facing argument descriptions are written only in Chinese, which imposes a specific language on users without offering a choice. The policy explicitly calls out language or locale constraints as violations unless the skill offers opt-in or documents a justified region-specific limitation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The argparse description, argument help text, and printed status/error messages are all in Chinese, so users are forced into one language during execution. There is no indication that the language choice is optional or that the tool is restricted to a justified Chinese-only context.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The manifest says this skill helps users discover bargain/hidden-city flight opportunities by analyzing routes and airfare options. This file instead implements a generic QR code URL generator for arbitrary links, which is unrelated to flight search or hidden-city fare analysis and represents behavior outside the described skill purpose.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This code depends on an external service and places user-controlled data into a remote request URL. That creates a real data egress path: any sensitive destination URL included by the user is exposed to the third-party QR provider and potentially to intermediary logs, analytics, or referrers.

Content

Scanner excerpt · scripts/qrcode.py (reported line 27)May include surrounding context.

python

二维码图片的 URL
    """
    encoded_url = urllib.parse.quote(url, safe='')
    return f"https://api.qrserver.com/v1/create-qr-code/?size={size}x{size}&data={encoded_url}"


def main():

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The generated URL embeds the full user-supplied link into a third-party QR service endpoint, which discloses that data to an external provider when the QR image is fetched. If users supply sensitive booking, account, or tracking links, those URLs may be logged or retained by the third party without the user's informed consent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Natural-language strings in the docstring and CLI help are presented only in Chinese, with no alternative language option or indication that the tool is region-specific. Under the policy criteria, this can be a language/locale policy violation because it imposes a fixed language on users without opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The argparse description says the tool is for conveniently scanning booking links, implying a flight-booking-specific purpose. In reality, the code simply encodes any user-provided URL into a third-party QR code service URL and performs no verification that the link is a booking link or related to airfare at all.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.