Security audit

Camping Glamping Spots

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent flyai travel-search wrapper, but it requires an unpinned global CLI install and hidden local logging of raw user queries in a way that needs review before installation.

Review before installing. Only use this skill if you are comfortable with a flyai/Fliggy booking-link workflow, and do not allow automatic npm global installation at runtime. Prefer manually reviewing and pinning the CLI dependency, and disable or modify the runbook logging so raw user queries are not persisted with shell commands.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:39
Finding: Unpinned Global Installation and Execution of a Third-Party CLI
Content: View full analysis
Remediation: View remediation
`. 2. Record and verify package integrity information using a lockfile or an equivalent checksum-based mechanism. 3. Prefer a project-local installation in an isolated directory over `npm -g`. 4. Review the package and its transitive dependencies before approving installation. 5. Disable lifecycle scripts during installation where compatible, then explicitly invoke only reviewed setup operations. 6. Run the CLI with least privilege and never instruct users to use `sudo` or an administrator account. 7. Require explicit user consent before downloading or installing the dependency. 8. Document the registry source, network destinations, data transmitted, and security assumptions. 9. Fail safely when the dependency is unavailable instead of making installation mandatory. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:31
Finding: Shell-Injection-Prone Persistence of Raw User Queries
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The documented schema stores the user's raw query inside `generation_log_json`, after which the complete serialized value is interpolated into a single-quoted shell command. Single quotes only protect shell data until another single quote occurs. If raw user input is inserted without robust shell escaping, an attacker can include a quote that terminates the intended string, append shell syntax, and cause commands to execute when the Agent follows the documented persistence procedure. For example, an input shaped like the following could break out of the quoted argument in an implementation that performs direct textual substitution: ```text ' ; attacker_command ; echo ' ``` JSON escaping alone does not make a value saf ...[truncated 1993 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The workflow explicitly mandates installing the CLI when it is missing and retrying automatically, with no user disclosure or consent. In an agentic setting this is more dangerous than a passive prerequisite because it operationalizes autonomous system modification, increasing the chance of silent package execution, persistence, and supply-chain compromise.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 134)May include surrounding context.
flyai search-poi --city-name "Huzhou" --category "露营"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 91% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version or immutable source revision. This can cause users to execute whatever package/version is current at install time, increasing supply-chain risk if the package is updated maliciously, compromised, or changed incompatibly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs automatic installation of a global CLI tool without user consent or warning about system modification. This creates a supply-chain and host-integrity risk because executing global package installation changes the environment and may run unreviewed code from an external package source.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger list includes the standalone term "outdoor," which is broad and commonly used in everyday speech across many unrelated contexts. This makes activation boundaries unclear and increases the chance the skill will trigger for requests that are not specifically about camping or glamping.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prerequisites section directs the operator to run npm i -g @fly-ai/flyai-cli without any cautionary language or approval gate. Even as documentation, this encourages unnecessary privileged environment changes and exposes users to package substitution or compromised dependency risks.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fallback instructs installing a global npm package and checking its version without any warning that this modifies the host environment and requires elevated trust in an external package. In an agent-skill context, this is risky because it can lead users or operators to change system state unnecessarily during normal use or troubleshooting, increasing supply-chain and environment-integrity risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, but provides no notice, minimization, or redaction guidance. In a travel-booking skill, users may provide names, locations, dates, passport or visa details, and other sensitive trip information, so capturing raw queries increases privacy and data-handling risk if logs are accessed, retained, or reused.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Taken together, the schema stores natural-language user_query content and then persists the generated log to disk, creating a durable record of potentially sensitive free-text inputs. Because this skill covers flights, hotels, visas, insurance, and itinerary planning, user prompts are especially likely to contain personal, financial, or identity-related details, making retention and leakage more dangerous in context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file without any safeguards around encryption, permissions, retention, or user disclosure. Persisting operational logs to disk creates a straightforward path for sensitive travel-related data to remain on the host and be exposed through local compromise, backup collection, or accidental sharing.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The instruction explicitly directs use of "Chinese/English variants" for city names, which imposes a language/locale behavior without indicating user choice or a documented regional justification. This matches the policy category for language or locale constraints applied without opt-in.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The manifest says the skill is powered by Fliggy (Alibaba Group), but the user-facing result template states 'Powered by flyai' instead. This creates a semantic mismatch between what the skill claims in its manifest and what its documentation/templates indicate the skill actually uses.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The failure-handling documentation tells users to check and invoke a 'flyai' CLI, while the manifest describes a Fliggy-powered travel skill. This is not merely incomplete documentation; it actively points to a different underlying system than the one the skill claims to use.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.