Security audit

Budget Hotel Finder

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real hotel-search integration, but it asks agents to auto-install an unpinned global CLI, build shell commands from user travel input, and persist raw queries in a local log.

Install only if you trust the flyai CLI and are comfortable with a third-party booking service receiving travel searches. Do not allow automatic global npm installation; pin and verify the CLI first, avoid shell-based command construction, and disable or remove the raw-query execution log before use.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Third-Party Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:73
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:92
Finding: Shell Command Injection Through Unescaped User-Controlled Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Undisclosed Persistent Logging of Raw Queries with Unsafe Shell Serialization
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the Agent to retain the complete raw user query, collected parameters, commands, fallback actions, and execution metadata in `.flyai-execution-log.json`. It explicitly states that this logging is internal and not shown to users. No consent requirement, retention period, access-control policy, redaction process, or secure deletion procedure is defined. Travel queries may contain sensitive itinerary details, dates, locations, ...[truncated 2466 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --max-price 500 --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-03

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest-level description emphasizes a narrowly scoped hotel-finding skill focused on sorting and filtering hotels under budget. However, the README says it 'wraps the flyai-cli to provide real-time travel data with booking links,' which expands the behavior beyond hotel search into generic travel data retrieval and booking facilitation.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever package version is current at install time. If the upstream package, dependency chain, or registry entry is compromised, users may execute attacker-controlled code during installation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Chinese documentation mirrors the same mismatch: the skill is presented as a hotel budget finder, but then claims to provide 'real-time travel data and booking links' through flyai-cli. That broader capability is not reflected in the narrow hotel-focused manifest description.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The Parameters table states --sort is 'Always price_asc' at L053, which directly conflicts with both the Sort Options table listing other supported values and the Playbook B/example commands using rate_desc at L066, L111, and L149. This is an active contradiction in the skill's own instructions about intended behavior, not merely an omission.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "最便宜的住一晚" is broad enough to match ordinary hotel-shopping requests and can cause this playbook to activate in situations where the user did not explicitly opt into this specific workflow. In a travel-booking skill, unintended activation can steer the agent toward executing a hotel search command automatically, increasing the risk of incorrect bookings, mismatched dates, or user-confusing behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook explicitly records raw user input in user_query and instructs the agent to append execution logs to a local file, creating a clear data-retention and privacy risk. Travel-related queries can contain names, destinations, booking details, dates, and other sensitive personal data, and the file persistence is described as internal and not shown to users, which removes transparency and increases the chance of undisclosed collection.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The schema requires retention of user_query as raw input, which can capture sensitive user-provided travel data and possibly credentials or identifiers pasted by mistake. Storing raw prompts internally is unnecessary for normal operation and expands the attack surface for data leakage, insider access, and unintended reuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending generated execution logs to .flyai-execution-log.json, which may persist user-derived data, command history, and operational context on the local filesystem. Persistent logs are commonly overlooked and can be exposed through backup systems, shared environments, weak file permissions, or later compromise of the host.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The failure template tells users to run local CLI commands such as flyai --version and retry with flyai {command} ..., which encourages action outside the skill’s stated hotel-finder purpose and could normalize executing shell commands provided by generated output. If {command} is derived from runtime context or user input, this pattern can facilitate unsafe command guidance, social engineering, or accidental execution of harmful commands on a user’s machine.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback command hard-codes the hotel type as "民宿", which imposes a specific language/locale choice in the skill content. The file does not indicate that this language is optional, user-selected, or justified as a region-specific requirement.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The playbook hard-codes English and Chinese trigger phrases, including the Chinese-only trigger on later lines, but does not state whether users may interact in other languages or choose their preferred locale. This can amount to an implicit language policy without user opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest frames this skill primarily as a budget hotel finder, but the template branding at the output layer presents it as a generic real-time booking surface powered by another platform. While not executable code, this documentation/output behavior broadens the apparent function beyond narrowly finding budget hotels and may mislead users about the skill's actual scoped purpose.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.