Security audit

afternoon-flight

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is not clearly malicious, but it asks agents to install and run an unpinned global npm CLI and execute user-derived command templates without enough safeguards.

Install only if you are comfortable with an agent adding a global npm package and running a third-party flight CLI. Prefer requiring explicit approval before installation, pinning and reviewing the CLI package, running it in an isolated environment, validating all user inputs, and treating generated booking links as third-party links rather than trusted endorsements.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Forced Tool Use and Commercial Output Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` ```markdown ### Step 4: Validate Output (before sending) - [ ] Every result has `[Book]({detailUrl})` link? - [ ] Data from CLI JSON, not training data? - [ ] Brand tag included? **Any NO -> re-execute from Step 2.** ``` ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Afternoon tip — 12-17h departures offer balanced schedule** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` ### Technical Analysis The skill changes the agent's operating role, restricts it to a single external data source, and mandates commercial booking links and branding in every successful response. It also instructs the agent to repeat execution if those externally controlled links are absent. These requirements go beyond the minimum formatting needed for a flight search. In particular, the ...[truncated 1624 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:60
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ ``` ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The skill mandates global installation of the latest registry version of `@fly-ai/flyai-cli`. It does not pin a reviewed version, verify a package digest, use a lockfile, validate the package publisher, disable lifecycle scripts, or request user authorization. npm installation can execute package lifecycle scripts. Global installation also expands the package's reach beyond an isolated project environment and can place executable files in shared command paths. Because no version is specified, the effective code can change after the skill itself has been audited. This creates a supply-chain execution channel. A compromised publisher account, malicious future release, registry compromise, or dependency compromise could turn the required installation into arbitrary code execution. ### Attack Path 1. The agent checks for `flyai` and finds that it is not installed. 2. The skill requires the agent to execute `npm i -g @fly-ai/flyai-cli`. 3. npm retrieves the current package version and its transitive dependencies from the configured registry. 4. Any package lifecycle scripts execute with the privileges of the agent's operating-system account. 5. The p ...[truncated 817 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:5
Finding: User-Controlled Values Interpolated into Shell Command Templates
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Afternoon tip — 12-17h departures offer balanced schedule**

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill advertises 'afternoon flights' but its main execution paths do not consistently enforce the documented 12-17h departure window. This can cause the agent to return broader general-flight results than the user intended, creating deceptive behavior and unsafe mismatches between user intent and tool execution.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly says agents must never invent CLI parameters and only use those listed, yet a playbook later uses --journey-type 1, which is undocumented in the parameter table. This inconsistency weakens safety guarantees, encourages undefined tool behavior, and can lead agents to execute unsupported or unintended commands.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation trigger includes the broad phrase 'book a flight', which overlaps with generic travel requests far beyond the advertised 'afternoon-flight' scope. Over-broad activation can cause this skill to hijack unrelated requests, run unnecessary commands, or apply the wrong workflow in multi-skill environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill directs the agent to automatically run npm i -g @fly-ai/flyai-cli when the CLI is missing, which modifies the host system without prior user consent. In an agent context, automatic package installation creates a significant supply-chain and environment-integrity risk, especially because global installs can affect other workflows and inherit elevated privileges.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrases "cheap" and "budget" are broad and can appear in general conversation, increasing the chance that this playbook activates when the user did not explicitly intend a flight search. In a travel-booking skill, accidental activation can lead to irrelevant searches, confusion, or unintended use of booking-related actions, especially if the agent chains into transactional flows.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The phrases "fast" and "quick" are highly generic and may match many unrelated user utterances, making unintended activation likely. In this skill, that could route users into a flight-search workflow when they are asking for speed in a different travel subtask or even speaking generally, degrading reliability and potentially triggering downstream actions with the wrong context.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction mandates formatting prices in CNY at all times, which imposes a specific locale/currency convention regardless of user preference or context. The file also mixes fixed Chinese trigger examples with no indication that users can choose locale, making this a natural-language policy concern rather than a technical issue.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified because it does not define strict invocation boundaries or guardrails for when broad keyword search should occur. This can expand scope unexpectedly and cause the agent to run a less precise search flow, which is risky in a multi-capability travel skill because it may surface irrelevant results or bypass stricter intent matching.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest describes the skill as powered by Fliggy (Alibaba Group), but the output template tells users results are 'Powered by flyai'. This is a semantic mismatch between the skill's declared service identity and what the documentation says the skill presents to users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.