ClawHub
Back to skill

Security audit

border-flight

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is coherent, but it asks agents to install an unpinned global CLI and can store raw travel queries locally without clear user control.

Install only if you are comfortable approving a global npm CLI dependency and sharing travel search details with flyai/Fliggy tooling. Prefer installing or verifying `@fly-ai/flyai-cli` yourself, avoid entering passport or sensitive identity details into ordinary search prompts, and check or delete `.flyai-execution-log.json` if you do not want local travel-query logs retained.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Intent-Code Divergence

Medium
Confidence
83% confidence
Finding
The skill requires visa reminders while also forbidding fabricated visa information and providing no visa lookup mechanism. In practice, this creates pressure for the agent to guess or hallucinate entry requirements, which can mislead travelers and cause booking or border-entry decisions based on incorrect compliance information.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill directs the agent to install and use an external CLI, likely invoking networked requests with user itinerary data, but gives no user-facing notice or consent step. This can expose sensitive travel details to a third-party service and expands the attack surface through package installation and command execution.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The runbook explicitly logs `user_query` as raw input in an internal execution log, which can capture sensitive personal, travel, identity, or payment-adjacent information users may provide during booking workflows. Because the log is internal and 'not shown to users,' there is no disclosure, minimization, or consent mechanism, creating a privacy and data-handling risk if logs are retained, accessed broadly, or exposed.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The documentation instructs persistent file-based logging of execution data to `.flyai-execution-log.json` without informing users that their interaction data may be stored on disk. In a travel-booking context, persisted logs can contain itinerary details, visa-related information, and other sensitive metadata, increasing exposure from local compromise, misconfiguration, or unintended sharing.

Static analysis

No suspicious patterns detected.