Security audit

beach-hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill is not clearly malicious, but it requires an unpinned global CLI install and mandatory third-party booking-link workflow without enough user control.

Review before installing. This skill should only be used if you are comfortable with a third-party travel CLI being installed globally and used as the mandatory source for results, including booking links. Prefer a sandboxed or project-local install, pin and verify the CLI version, ask before installing, and validate all route/date inputs before executing commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Agent Behavior and Commercial Output Injection
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` `SKILL.md:119-142`: ```markdown ### Step 3: Format Output Format CLI JSON into user-readable Markdown with booking links. See [references/templates.md](references/templates.md). ### Step 4: Validate Output (before sending) - [ ] Every result has `[Book]({detailUrl})` link? - [ ] Data from CLI JSON, not training data? - [ ] Brand tag included? **Any NO -> re-execute from Step 2.** ## Usage Examples ```bash flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2 ``` ## Output Rules 1. **Conclusion first** — lead with best option 2. **Beach hotel tip — Sanya, Xiamen, and Beidaihe are top domestic beach spots** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` `references/templates.md:31-46` ...[truncated 2361 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:63
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` `references/fallbacks.md:3-9`: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ **NEVER proceed without CLI. NEVER fabricate results.** ``` `references/fallbacks.md:20-24`: ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The skill mandates global installation of `@fly-ai/flyai-cli` without an exact version, integrity hash, lockfile, package provenance verification, or user confirmation. The package identifier therefore resolves to whatever release the registry currently considers appropriate. npm packages may execute lifecycle scripts during installation. A compromised package, maintainer account, registry response, or subsequently malicious release could execute code with the privileges of the account running the agent. The global installation flag also modifies shared tooling outside an isolated project environment and makes the installed command available to later sessions. The audit did not establish that the named package is itself malicious. The confirmed issue is the unsafe, mutable, and mandatory dependency installation process. ### Attack Path 1. The agent checks for `flyai` and receives `command not found`. 2. The skill requires the agent to run `npm i -g @fly-ai/flyai-cli`. 3. npm resolves an unpinned package ve ...[truncated 1123 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:92
Finding: Shell Command Injection Through User-Controlled CLI Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Beach hotel tip — Sanya, Xiamen, and Beidaihe are top domestic beach spots**

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill uses a mandatory step-by-step narrative that forces environment checks, installation, and external command execution before serving the user. This trust-then-action flow is dangerous because it normalizes automatic execution of untrusted tooling and can pressure an agent to take irreversible actions prior to confirming safety or obtaining consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill directs the agent to install a global npm package and execute it without requiring explicit user consent or warning that the action will modify the host environment. Installing and running external tooling expands the attack surface, can introduce supply-chain risk, and may violate the principle of least surprise for users.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly claims that only parameters listed in the Parameters table may be used, but Playbook D invokes --journey-type 1, which is undocumented. This mismatch can cause agents to execute unsupported or unintended behavior and weakens the safety boundary the skill itself establishes around command construction.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The trigger list includes very common words like "cheap" and "budget" without any travel-specific constraint or negative examples. In a markdown playbook, such broad phrases can overlap with ordinary user speech and make it unclear when this flight-search playbook should activate versus unrelated contexts.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The triggers "fast" and "quick" are generic everyday words and do not clearly indicate a flight-search intent on their own. Because the file does not provide exclusion conditions or a narrow invocation context, these terms could activate the playbook unexpectedly.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The instruction to always format prices in CNY imposes a specific locale/currency convention in natural-language guidance. The file does not offer a user choice or explain that the skill is limited to a China-specific context, so this appears to violate the language/locale policy requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The file hard-codes both English and Chinese trigger phrases, but it does not explain whether multilingual triggering is optional, configurable, or based on user preference. Organizational language policy can be implicated when language behavior is predetermined without an explicit user choice or documented justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The condition "0 results from above playbooks" does not clearly define whether this fallback is automatic, manual, or tied to a specific failed search state. That ambiguity can lead to inconsistent invocation behavior and makes the trigger boundary unclear.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The manifest describes the skill as being powered by Fliggy (Alibaba Group), but the template explicitly instructs output to display 'Powered by flyai'. This is a direct contradiction in documentation/output guidance about the service identity, which can misrepresent the skill's actual provider to users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.