Security audit

anniversary

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill has a coherent purpose, but it requires unpinned global CLI installation, executes user-derived shell commands, and persists raw travel queries without clear consent or safeguards.

Review carefully before installing. Only use this skill if you trust the flyai npm package and are comfortable with a global install, external booking links, and local logging of travel queries. Prefer a version that pins and verifies the CLI, asks before installing or writing logs, validates user input, and uses safe non-shell process execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Promotional Output and Agent Behavior Override
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:42
Finding: Unpinned Global Installation and Execution of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:19
Finding: Shell Command Injection Through Unsanitized Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:33
Finding: Plaintext Persistence of Raw User Queries and Executed Commands
Content: View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The runbook directs the Agent to store the raw user query, collected parameters, full commands, timestamps, and recovery actions in a persistent plaintext file. Travel routes and dates can reveal sensitive personal plans and behavioral information. No user consent, retention period, redaction policy, encryption requirement, restrictive file mode, or deletion process is specified. The dot-prefixed filename only reduces casual visibility; it does not provide access control. The serialization mechanism is also unsafe. Placing generated JSON inside a single-quoted `echo` shell command can be broken by an apostrophe or other crafted content originating from the raw query. If the Agent executes the generated command through a shell, this creates a sec ...[truncated 1578 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-06-14 --journey-type 1 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best couple-friendly option 2. **Romantic tip** — suggest romantic destinations or timing

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly directs the agent to install a global npm package and execute its CLI as a mandatory prerequisite, but provides no user-consent step, trust verification, or sandboxing guidance. This creates a supply-chain and arbitrary command-execution risk because the agent may modify the host environment and run untrusted third-party code purely based on skill instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger definition includes Chinese phrases as required activation language, but the file does not state that the skill is region-specific or that users may choose their preferred language. This creates a natural-language locale policy concern because the skill appears to hard-code language-specific invocation patterns without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This trigger list again embeds Chinese-only activation phrases alongside English ones without explaining locale scope or offering a language choice. Under the policy, language constraints should be optional or clearly justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The playbook defines Chinese trigger phrases but does not document locale restrictions or user language selection. This is a policy issue because language-specific activation is being imposed implicitly rather than offered as a choice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly stores the raw user query in an internal execution log and instructs the agent to persist logs to a local file, while also stating the log is not shown to users. In a travel-booking skill, raw queries can contain personal and sensitive data such as names, destinations, dates, passport or visa details, and special requests, so retaining them without clear notice, minimization, or retention controls creates a real privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template claims results are 'Powered by flyai' even though the skill metadata says the service is powered by Fliggy. This provider mismatch can mislead users about the source of travel data and booking links, weakening trust boundaries and increasing phishing, impersonation, or unsafe redirection risk if users rely on the displayed branding.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The failure template instructs users to use 'flyai' and a 'flyai-cli' even though the skill is described as Fliggy-powered. In a travel-booking context, directing users to the wrong tool or ecosystem can cause credential exposure, accidental use of unauthorized software, or trust confusion that attackers could exploit through typosquatting or fake CLI distributions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.