Security audit

anniversary-flight

Security checks for vulnerabilities and agentic risk

Overview

This anniversary flight skill is mostly aligned with flight search, but it needs review because it can make a persistent global npm installation and run external CLI searches without a clear consent gate.

Install only if you trust the flyai/Fliggy CLI and are comfortable sharing route and date searches with that provider. Prefer approving installation manually, using a sandbox or project-local install, and pinning or reviewing the package version before use.

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill explicitly states that only parameters listed in the Parameters table may be used, but later instructs use of `--journey-type 1`, which is undocumented in the same file. This inconsistency can cause agents to invoke unsupported or unreviewed CLI behavior, undermining guardrails and making command generation less predictable and less auditable.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: Using the generic trigger phrase `book a flight` makes the skill activate for broad, everyday travel requests rather than the narrowly described anniversary-use case. Overbroad activation increases the chance the agent will execute the skill in unintended contexts, including unnecessary command execution or package installation for routine queries.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The Chinese trigger `订机票` is a very broad phrase equivalent to general flight booking, not specifically anniversary travel. This can cause unintended activation across many normal user requests, expanding the skill's execution footprint and increasing the likelihood of unnecessary CLI use or system modification.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill frames the agent as a CLI executor and requires all answers to come from CLI output, but does not require user consent or provide warnings before command execution and possible installation. In agent environments, this can lead to silent local command execution and environment changes that users did not explicitly authorize.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli`, which performs a global package installation and modifies the host environment without a mandatory user-facing warning or consent step. Automatic installation from within a skill significantly raises risk because it introduces supply-chain exposure and persistent system changes beyond the immediate task.

Static analysis

No suspicious patterns detected.