Security audit

Capsule Pod Hotel

Security checks across malware telemetry and agentic risk

Overview

This travel skill is mostly purpose-aligned, but it can install a global third-party CLI and persist raw user travel queries in a local log without clear user control.

Install only if you are comfortable trusting the @fly-ai/flyai-cli npm package and sending travel queries through it. Prefer installing the CLI yourself after reviewing its source/package provenance, run the skill in a contained workspace, and delete or disable .flyai-execution-log.json if you do not want raw travel queries retained locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Description-Behavior Mismatch

Medium

Confidence: 84% confidence
Finding: The README presents the skill as narrowly focused on finding capsule or pod hotels, but also discloses that it wraps flyai-cli for real-time travel data and booking links. This mismatch can mislead users and agents about the skill's actual behavior and external integrations, increasing the chance of unintended network access, data handling, or booking-related actions being invoked under a narrower trust assumption.

Intent-Code Divergence

Medium

Confidence: 86% confidence
Finding: The "What It Does" section claims the skill only finds capsule or pod hotels, while earlier text states it provides real-time travel data and booking links. In an agent ecosystem, this kind of capability understatement is security-relevant because operators may authorize or compose the skill assuming a smaller privilege and action surface than it actually has.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The skill instructs the agent to install and execute an external CLI (`npm i -g @fly-ai/flyai-cli`) as a mandatory step, without requiring explicit user consent or warning that this changes the host system. In an agent setting, this creates a supply-chain and system-modification risk: a user asking for hotel results could indirectly trigger package installation and execution of untrusted code.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records `user_query` as raw input in an internal execution log, which can capture personal data, credentials, payment details, travel plans, or other sensitive information without any notice, minimization, or retention controls. In a travel-booking skill, users are especially likely to submit identifying and itinerary data, so storing raw queries increases privacy and compliance risk if logs are accessed, leaked, or reused improperly.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of user inputs, commands, and operational metadata without disclosure or safeguards. Persistent local logging increases the chance that sensitive travel and booking data remains on disk longer than necessary, can be read by other processes or operators, and may be exfiltrated through backups or host compromise.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.