Security audit

Capsule Pod Hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel skill has a legitimate purpose, but it automatically installs an unpinned global CLI and persists raw user travel queries in ways that need review before use.

Review this skill before installing. Use it only in a sandbox or controlled environment, require explicit approval before installing `@fly-ai/flyai-cli`, prefer a pinned and reviewed CLI version, and avoid entering sensitive personal or travel details until the logging and command-construction patterns are fixed.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:12
Finding: Mandatory Agent Role and Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:40
Finding: Unpinned Global npm Package Installation
Content: View full analysis
Remediation: View remediation
`. 2. Verify package integrity against a trusted digest or signed provenance record. 3. Use a project-local dependency and committed lockfile instead of global installation. 4. Run installation only after explicit user approval. 5. Disable npm lifecycle scripts where compatible, such as with `--ignore-scripts`. 6. Execute the dependency in a restricted sandbox with minimal filesystem and network access. 7. Review all transitive dependencies and use automated vulnerability and provenance checks. 8. Do not automatically install a missing dependency as part of answering an ordinary user query. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Shell Injection Through Execution-Log Persistence
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook places the raw user query into generated JSON and then interpolates the complete JSON value into a single-quoted shell command. No JSON serialization, shell escaping, or safe file-writing API is specified. A single quote inside attacker-controlled input can terminate the shell's quoted string. Subsequent shell metacharacters can then be interpreted as executable syntax. JSON escaping alone would not make the value safe for shell interpolation because JSON and shell quoting follow different rules. The behavior additionally stores raw user input and command details in a persistent local file without specifying file permissions, retention limits, redaction, or protection against symbolic links. ### Attack Path 1. An attacker supplies a travel query containing a single quote followed by shell syntax, such as ...[truncated 1300 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:89
Finding: Command Injection Through User-Controlled CLI Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 139)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --key-words "太空舱" --sort price_asc --check-in-date 2026-05-01 --check-out-date 2026-05-02

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README presents the skill as narrowly scoped to finding capsule hotels, but also says it wraps flyai-cli for real-time travel data and booking links, implying broader capabilities than the headline suggests. This scope mismatch can mislead users and agents about what actions, data access, or third-party interactions may occur, undermining informed consent and safe tool use.
Content: No source excerpt is available for this finding.

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific version, which can cause execution of whatever package/version is current at install time. That creates a supply-chain risk: a compromised or malicious upstream package update could execute code on the user's system during installation.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The 'What It Does' section claims the skill only finds capsule/pod accommodation, while nearby text describes broader real-time travel and booking-link functionality via flyai-cli. In agent ecosystems, understated capabilities are dangerous because they can hide transactional or data-sharing behavior behind a seemingly narrow discovery tool.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill instructs the agent to install and run a CLI tool without warning that this modifies the host system. In an agent context, automatic package installation can introduce supply-chain risk and unexpected system changes, especially if executed without explicit user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The prerequisites section normalizes npm i -g as a setup step without disclosing that it performs persistent global modification. This is dangerous because users or agents may treat it as harmless preparation and inadvertently trust an unpinned external package with broad execution rights.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: This is an active contradiction inside the skill documentation: the parameter guidance restricts --sort to price_asc, while Playbook B later instructs use of --sort distance_asc. That divergence can mislead an agent about intended behavior and cause inconsistent execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The environment-check workflow explicitly directs automatic global installation when the command is missing, with no consent checkpoint or risk notice. In a tool-using agent, this can cause unreviewed code execution and persistent system modification, making supply-chain compromise or accidental host alteration materially more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly stores the user's raw input in an internal execution log as user_query, but provides no user notice, minimization, or redaction guidance. In a travel-booking skill, users may include personal, financial, passport, itinerary, or contact information in free-form queries, so retaining raw text creates avoidable privacy and data exposure risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Taken together, the runbook directs the agent to retain raw natural-language user input and persist execution details to disk, creating a straightforward data leakage path. This is more concerning in this skill's context because travel requests commonly contain PII and sensitive trip details, making accidental disclosure, over-retention, or secondary misuse more likely.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file when filesystem writes are available, again without notice, access controls, or retention constraints. Persisting operational logs to disk increases the blast radius of any sensitive data captured earlier, because local files are often copied, backed up, or read by other processes/users.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description says the skill 'also supports' flights, train tickets, attractions, itinerary planning, visa info, insurance, car rental, and more. However, the actual workflow in this file is entirely centered on hotel search via flyai search-hotel, specifically capsule-hotel scenarios, with no documented commands or handling for those other travel functions.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The fallback explicitly hard-codes a Chinese hotel type value ("民宿") without any indication that the user's language or locale was considered. This can cause the skill to override user preferences or behave inconsistently across locales, which is a genuine policy/quality issue, though its security impact is limited in this travel-booking context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.