Security audit

babymoon

Security checks across malware telemetry and agentic risk

Overview

This flight-search skill is mostly coherent, but it tells the agent to automatically install an unpinned global npm CLI before use.

Review the flyai npm package and publisher before installing. Prefer a sandbox, container, or local/project install instead of a global install, and only allow installation after explicit approval. Share only route/date details needed for the search and verify booking links before purchasing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The skill establishes a strict allowlist narrative for CLI parameters, but later examples and mappings introduce flags not declared in the Parameters table. This inconsistency can cause an agent to trust contradictory instructions, invent or accept undeclared flags, and execute commands outside the reviewed interface.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The manifest description advertises broad travel capabilities far beyond babymoon flights, increasing the chance the skill is selected for unrelated tasks. Over-broad activation widens the command-execution surface and may route users into this skill when a narrower, safer skill should handle the request.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to perform a global npm installation and execute system commands without any explicit user consent or warning about modifying the host environment. That creates a supply-chain and environment-integrity risk, especially on shared or sensitive systems, because merely using the skill can lead to persistent system changes.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger set for PB-3 includes very generic terms like "fast" and "quick", which can appear in many ordinary travel requests and may activate this playbook without sufficient user intent specificity. In a booking skill, this can steer execution toward a specific search mode unexpectedly, causing incorrect flight searches or unintended automation based on ambiguous language.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The PB-6 fallback is triggered by "0 results from above playbooks," then issues a broad `keyword-search` using interpolated origin/destination text. Because this fallback is intentionally broad and not tightly scoped to explicit user confirmation, it can activate in loosely matched situations and expand the search behavior beyond the original constrained command path.

Ssd 4

Medium

Confidence: 90% confidence
Finding: The workflow says agents must never invent parameters, yet nearby playbooks normalize alternate command forms and create ambiguity about what is permitted. In security-sensitive agent settings, contradictory guidance increases the chance that the model synthesizes unsupported flags and executes unintended commands.

Ssd 4

Medium

Confidence: 98% confidence
Finding: The domain-mapping section quietly introduces undeclared flags like journey and seat-class options after asserting a strict allowlist. This is more dangerous than a documentation typo because it teaches the agent to bypass earlier safety constraints and may expand execution into unreviewed CLI features.

VirusTotal

No VirusTotal findings

View on VirusTotal

Static analysis

No suspicious patterns detected.