ClawHub
Back to skill

Security audit

beach-hotel

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is mostly coherent, but it tells agents to install and run an unpinned global npm CLI automatically if it is missing.

Install only if you are comfortable with an agent installing and running @fly-ai/flyai-cli globally. Prefer manually installing or pinning the CLI yourself, reviewing the package source/provenance, and requiring confirmation before any booking or payment step.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
95% confidence
Finding
The skill explicitly says agents must only use parameters listed in the Parameters Table, but Playbook D instructs use of `--journey-type 1`, which is undocumented. This creates unsafe ambiguity: the agent may invoke unsupported behavior or rely on hidden CLI functionality, undermining the file's own safety constraints and making command execution less predictable.

Vague Triggers

Medium
Confidence
87% confidence
Finding
The activation trigger includes the broad phrase `find a hotel`, which overlaps with ordinary hotel/travel requests well beyond beach-hotel-specific intent. This can cause the skill to activate in unrelated contexts and push users into unnecessary CLI execution and booking-oriented flows they did not request.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill's execution rules instruct the agent to install `flyai-cli` if it is not present, without requiring user consent or warning about system modification. In an agent environment, this can lead to unauthorized global package installation and execution of third-party code on the host.

Missing User Warnings

High
Confidence
99% confidence
Finding
The workflow contains a concrete global install command, `npm i -g @fly-ai/flyai-cli`, and directs the agent to run it automatically if the command is missing. This is dangerous because it performs persistent environment changes and executes externally sourced code without an explicit trust boundary, warning, or confirmation from the user.

Static analysis

No suspicious patterns detected.