airport-lounge

• Analyzed: Apr 24, 2026, 6:31 AM
• Findings: 1
• Version: 3.2.0
• Hash: d147a7d88b911644d8c753a7b5e279a3e927a39e3eb5f1edf2e35d3d15bf7cc9
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill requires the agent to perform a global installation of an external NPM package (@fly-ai/flyai-cli) and execute shell commands to search for flights. While these actions are consistent with the stated purpose, the mandatory 'npm i -g' command and the forceful instructions in SKILL.md to bypass the agent's internal knowledge base represent a significant security risk and potential for supply chain exploitation. No direct evidence of malicious exfiltration was found, but the broad execution permissions and requirement to install external binaries warrant a suspicious classification.