Security audit

Budget Trip Planner

Security checks for vulnerabilities and agentic risk

Overview

This travel skill has a coherent purpose, but it mandates an unpinned global CLI install, forces externally supplied booking links, and persists raw user-query logs without clear user control.

Install only after reviewing the flyai CLI source and package version, pinning the dependency, and deciding whether you are comfortable with global npm changes, externally supplied booking links, and local retention of raw trip queries. Do not let the skill book, reserve, purchase, submit personal data, or open booking links without an explicit user confirmation step and URL validation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Mandatory Agent Behavior Override and Promotional Output Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:126
Finding: Unpinned Global Installation and Execution of Mutable Third-Party Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:32
Finding: Shell Command Injection Through Raw User Queries and Generated Log Content
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The documented fallback inserts the raw user request into a shell command. Double quotes do not provide complete shell isolation: an attacker may terminate the quoted argument, introduce shell operators, or use shell-supported substitution syntax if the command is assembled and executed through a shell. The log command is more directly unsafe. Generated JSON contains the raw user query and complete command strings, and the entire JSON value is placed inside single shell quotes. A single quote originating from user-controlled content can terminate that quoting context. Additional shell syntax can t ...[truncated 1273 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistent Storage of Raw User Queries and Command History
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The Skill instructs the Agent to retain raw user input, collected parameters, complete CLI commands, fallback commands, timestamps, and request identifiers in `.flyai-execution-log.json`. It explicitly states that the internal log is not shown to users. Travel requests may contain personal information such as planned locations, dates, ac ...[truncated 1503 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 202)May include surrounding context.
Full budget orchestration

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 90% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/budget-trip-planner, which references a moving main branch rather than an immutable version or commit. This creates a supply-chain risk: the content fetched later could differ from what was originally reviewed, and a compromised or malicious upstream change could be installed by users without notice.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The skill advertises booking, reservation, ticketing, insurance, visa, and car-rental capabilities but provides no user-facing warning that these operations may trigger consequential real-world actions or financial commitments. In an agent workflow, this can normalize progressing toward purchases or reservations without an explicit confirmation boundary, increasing the risk of unintended transactions or user confusion.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to install and run a global npm package (npm i -g @fly-ai/flyai-cli) as a mandatory prerequisite, with no user consent checkpoint or warning that this modifies the host environment. In an agent setting, this creates supply-chain and environment-modification risk because the package could change over time, execute install scripts, or introduce unsafe behavior on the system before the user understands the consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback instructs installing a global npm package and immediately executing it, which modifies the user's system and expands trust to code fetched from the registry without any warning, consent, or safer alternative. In an agent skill context, this is risky because users may treat fallback guidance as authoritative recovery steps and run privileged setup commands they did not intend to execute.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "good but cheap" is broad, natural conversational language that can easily appear in unrelated user requests. In a skill system that routes or activates playbooks based on trigger text, this ambiguity can cause unintended activation of the wrong workflow, producing actions or recommendations the user did not explicitly request. Because this travel skill can support bookings and reservations, mistaken routing is more sensitive than in a read-only skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The file describes internal logging of raw input, commands, fallback behavior, and optional file persistence, but provides no user-facing warning or consent mechanism for this retention and storage. In the context of a budget travel and booking skill, users may submit sensitive itinerary, identity, and financial-adjacent details, making undisclosed logging materially more dangerous and potentially non-compliant with privacy expectations.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly captures the raw user query and full CLI commands in an internal execution log, which is a form of data collection and retention beyond the advertised trip-planning and booking functionality. In a travel skill, user queries may contain names, destinations, dates, passport/visa details, budgets, or other sensitive travel context, so retaining them increases privacy and misuse risk if logs are exposed or reused.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of operational and user-derived data that is not disclosed in the skill description. Persistent local logs increase the blast radius of any host compromise, accidental sharing, or multi-tenant leakage because data survives beyond the active session.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.