Security audit

birthday-trip

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is not clearly malicious, but it asks for broad, under-scoped authority to install software, run shell commands, and persist raw travel queries.

Review carefully before installing. Only use this skill if you are comfortable with a third-party flyai CLI being installed globally, your travel searches being sent through that provider, provider booking links being required in responses, and raw query details potentially being written to a hidden local log. Prefer a version that pins the CLI package, requires explicit install consent, validates parameters, avoids shell interpolation, and disables or redacts persistent logs by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Agent behavior and output are hijacked to enforce a commercial provider
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:35
Finding: Unpinned third-party npm package is installed globally
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:70
Finding: User-controlled travel parameters are interpolated into shell commands
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Raw user queries are persisted through an injection-prone shell logging command
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the complete raw user query, command history, fallback actions, and operational metadata in a hidden local file. It provides no user-consent mechanism, data minimization, retention period, access-control requirements, encryption, or deletion procedure. Travel queries can reveal locations, dates, budgets, and other personal plans. The logging mechanism also embeds generated JSON inside a single-quoted shell command. JSON escaping does not protect shell quoting: an apostrophe originating from a raw query can terminate the shell's single-quoted string. If the generated log is substituted textually into this command, the remaining content can be interpreted as shell syntax. Concurrent appends can also corrupt the log because no locking or structured append mech ...[truncated 1275 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 129)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Chengdu" --dep-date 2026-08-20 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best birthday-friendly option 2. **Birthday tip** — suggest popular birthday destinations

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest description claims support for hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. However, the actual skill file only defines flyai search-flight and one flyai keyword-search fallback, with all playbooks centered on flight lookup rather than those broader services.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The execution rules at L017 say to use only parameters listed in the Parameters table, but Playbook B invokes --sort-type 3 at L091 while the table at L054 documents only a default of 2 and does not define 3 as a valid value. This is an active contradiction between the file's own guidance and its example command.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger definition includes Chinese phrases as required activation examples alongside English, but the file does not state that language selection is optional or user-driven. This creates a natural-language locale policy concern because the skill embeds specific language requirements without opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This trigger line again specifies Chinese-language phrases as activation phrases without clarifying that users may choose their own language. Repeating fixed locale-specific trigger wording across playbooks reinforces a language-policy issue.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill lists Chinese trigger phrases as part of the activation wording but does not provide an explicit language choice or a justified region-specific scope. That is a natural-language policy concern under the language/locale rule.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture personal, financial, travel, passport, visa, and other sensitive booking details. Because the log is described as persistent and there is no documented notice, minimization, redaction, or retention control, this creates a real privacy and data-handling vulnerability rather than a harmless operational detail.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating durable storage of operational data that may include sensitive user content and command history. In a travel-booking skill, those logs can contain high-value personal and itinerary information, and the absence of warning, retention limits, file protection guidance, or opt-in consent increases the risk of unauthorized access or unintended disclosure.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The manifest says the skill supports flights, hotels, trains, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. This file's operational templates and parameter collection are exclusively for flight search and booking output, with no indication of the broader capabilities described in the manifest.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: The manifest description says the skill is powered by Fliggy (Alibaba Group), but the template tells users it is 'Powered by flyai'. That is an active contradiction in user-facing documentation about what service backs the skill.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.