Security audit

birthday-flight

Security checks for vulnerabilities and agentic risk

Overview

This appears to be a real flight-search skill, but it tells agents to install an unpinned global CLI package and run external travel searches without clearly requiring user approval.

Install only if you are comfortable with an agent running live travel-search commands and installing @fly-ai/flyai-cli globally. Require confirmation before any package install, prefer a pinned or isolated install, and treat all booking links as external checkout links that need manual review.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Low

Confidence: 93% confidence
Finding: The template instructs the agent to present results as 'Powered by flyai' even though the skill metadata identifies Fliggy as the provider. This can mislead users about the source of pricing and booking links, weakening provenance and trust, and could facilitate phishing or dispute-handling confusion if users click through assuming a different service relationship.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to globally install an external package with `npm i -g @fly-ai/flyai-cli` if the tool is missing, without any user confirmation or warning that the environment will be modified. This creates a supply-chain and environment-modification risk, especially in automated agent contexts where executing install commands may be treated as routine.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger phrases in these playbooks include very generic terms such as "cheap," "budget," "fast," and "quick," which are likely to appear in ordinary conversation outside an explicit flight-booking request. In an agentic environment, this can cause unintended skill activation and execution of travel-search commands using partially inferred parameters, leading to confused-deputy behavior or actions taken in the wrong context.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and does not define clear boundaries for when the skill may broaden scope. That ambiguity can cause the agent to invoke keyword-based search unexpectedly after unrelated or weak matches, increasing the chance of unintended external queries and behavior that does not reflect the user's precise request.

Ssd 4

Medium

Confidence: 97% confidence
Finding: The workflow establishes a trust-to-action chain: verify the tool, automatically install it if absent, then execute it and forbid safer fallback behavior. In an agent setting, this pressures the model into taking external actions and changing the host environment before user consent, increasing the chance of unsafe command execution and third-party code exposure.

Static analysis

No suspicious patterns detected.