Security audit

Business Class Finder

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill has a coherent travel purpose, but it asks agents to install and run an unpinned CLI, even with sudo fallback, and to persist raw user queries without clear consent or limits.

Review before installing. Only use this skill if you trust the flyai CLI and its package source, avoid sudo/global installation where possible, run it in a constrained environment, and be aware that it may add booking links, relax travel constraints, and write raw travel queries to a local log.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:12
Finding: Mandatory Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:5
Finding: Unpinned Global Package Installation with Root Escalation
Content: View full analysis
Remediation: View remediation
``` 2. Verify package integrity through a lockfile, known digest, signature, or trusted provenance attestation. 3. Remove the `sudo npm i -g` fallback completely. 4. Avoid global installations. Use a project-local dependency in an isolated, least-privileged environment. 5. Disable or carefully control dependency lifecycle scripts where operationally possible. 6. Pin repository-based installation commands to an immutable commit rather than a mutable branch path. 7. Require explicit informed user approval before downloading or installing any dependency. 8. Run the CLI in a sandbox with minimal filesystem and network access. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:103
Finding: Shell Command Injection Through Unsanitized Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:3
Finding: Undisclosed Persistent Logging of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the complete raw user query, collected parameters, generated commands, fallback commands, and operational metadata. It explicitly states that this logging is internal and not shown to users. Travel queries may reveal names, locations, dates, budgets, travel patterns, or other sensitive contextual information. The design specifies no consent mechanism, redaction policy, file permissions, retention period, rotation, deletion procedure, or encryption. The logging command is also unsafe because JSON is interpolated into a single-quoted shell command. A raw user query containing a single quote can terminate the shell string. If the generated command is executed through a shell, this creates an additional command-injection path beyond ...[truncated 1538 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (14)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "New York" --dep-date 2026-07-01 --seat-class-name first --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever version is current at install time. If the upstream package, dependency chain, or registry resolution is compromised, users may execute unintended code during installation, making this a supply-chain risk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to install a global npm package as a mandatory step before answering. This introduces unnecessary code-execution and supply-chain risk for a read/search task, since installing and running third-party CLI tooling can execute untrusted package lifecycle scripts and expand host capabilities beyond what the user explicitly requested.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest and overview frame the skill around business class and first class flight search, but Playbook C explicitly handles 'premium but not too expensive' by showing premium economy alternatives. Premium economy is outside the stated 'premium cabin flights — business class and first class' scope described in the manifest and core overview.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documentation recommends retrying installation with sudo, encouraging privileged execution of a package-manager command. Running npm global installs as root increases the blast radius of a malicious or compromised package and can lead to host-level compromise rather than a contained user-level issue.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill instructs the agent to silently broaden the user's search by expanding dates, adding connections, and falling back to broad keyword search without first warning the user that their constraints are being relaxed. In a travel-booking context, this can produce misleading results, violate user intent, and nudge users toward options they did not authorize or want.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Automatically increasing the user's budget threshold by 30% changes a core user constraint without consent. In a commerce-oriented travel skill, this can manipulate recommendations toward more expensive options and undermine user trust, especially if later flows support booking or affiliate-driven conversions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The instruction to auto-search tomorrow after an invalid or passed date overrides a material user parameter without consent. In a booking and itinerary context, changing the date can lead to inappropriate travel recommendations, mistaken assumptions, or unintended downstream actions if connected booking flows rely on the modified search.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "premium but not too expensive" is broad and subjective, so the skill may activate when a user is expressing a general preference rather than explicitly requesting this workflow. In a travel-booking context, unintended activation can lead to irrelevant flight searches or parameter mapping mistakes, which may confuse users and cause incorrect downstream actions if the agent proceeds too aggressively.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs raw user input in user_query and persists execution logs to a local file, but provides no data minimization, retention limits, redaction rules, or user notice. In a travel skill, user queries may contain names, passport or visa details, booking references, destinations, dates, and other sensitive travel data, so persistent storage increases privacy and unauthorized access risk.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The documentation first instructs not to search when a date has passed, then immediately says to auto-search tomorrow. These two directions are in tension: one forbids searching, while the next performs a search anyway. This is an intent-level contradiction in the fallback instructions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The playbook defines trigger phrases only in English and Chinese (e.g. "business class", "商务舱", "first class", "头等舱") without stating that language choice is optional or user-selectable. This can create a locale/language policy issue because the skill appears to privilege specific languages without documenting opt-in or regional scope.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill is powered by Fliggy (Alibaba Group), but the templates present results as 'Powered by flyai' and instruct retries via a 'flyai' CLI. This creates a semantic mismatch between the skill’s claimed service/backend and what the documentation indicates it actually uses.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The inline output templates explicitly tell users that pricing and booking are powered by 'flyai' and that real-time data depends on a 'flyai-cli', which conflicts with the manifest’s claim that the skill is powered by Fliggy. This is not merely incomplete documentation; it actively points to a different implementation/provider.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.