Security audit

castle-hotel

Security checks for vulnerabilities and agentic risk

Overview

The skill is travel-related rather than clearly malicious, but it should be reviewed because it mandates installing and running an unpinned global CLI and forces booking-link output for broad travel requests.

Install only if you trust the flyai CLI publisher and are comfortable with a global npm package being installed and used for travel queries. Require explicit approval before any install, prefer a pinned and reviewed version in an isolated environment, and be cautious with generated booking links because the skill requires them in responses.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Commercial Output and Agent Role Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` Related mandatory output instructions also appear at `SKILL.md:124-145` and `references/templates.md:29-46`: ```markdown ### Step 4: Validate Output (before sending) - [ ] Every result has `[Book]({detailUrl})` link? - [ ] Data from CLI JSON, not training data? - [ ] Brand tag included? **Any NO -> re-execute from Step 2.** ``` ```markdown ## Notes - Always include [Book](detailUrl) links - Format prices in CNY (Y) - Include at least 3 results when available ``` ### Technical Analysis The Skill redefines the Agent's role and establishes mandatory final-response constraints unrelated to neutral task execution. It requires every result to contain third-party booking links and requires a promotional brand tag. The self-test and re-execution rule reinforce these constraints by preventing the Agent from returning a response unless the commercial content is present. This behavior is instruction hijacking because loading the Skill changes the Agent's current-session goals from assisting the user to enforcing use and promotion of a specific external service. The boo ...[truncated 1413 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:64
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The same installation behavior is repeated at `references/fallbacks.md:3-10` and `references/fallbacks.md:20-24`: ```markdown If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ ``` ```bash npm i -g @fly-ai/flyai-cli ``` ### Technical Analysis The Skill requires automatic global installation of `@fly-ai/flyai-cli` without pinning a reviewed version, checking an integrity hash, auditing package contents, disabling lifecycle scripts, or obtaining informed user approval. An unversioned npm installation resolves to whichever release is current at execution time. Therefore, the effective code can change after the Skill itself has been reviewed. npm packages may execute lifecycle scripts during installation, and global installation places executable components into system- or user-wide npm locations. The audit did not establish that the named package is currently malicious. The vulnerability is the unsafe dependency acquisition and execution process, which creates a supply-chain execution channel. ### Attack Path 1. The Skill checks whether `flyai` is installed. 2. If the executable is absent, the Agent is instructed to run `npm i -g @fly-ai/flyai-cli`. 3. npm resolves and downloads the current package release and its transitive dependencies. 4. Any package lifecycle scripts execute with the privileges of the Agent's npm process. 5. Package executables are installed globally and become available outside the immediate Skill invocati ...[truncated 1017 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:92
Finding: Shell Command Injection Through User-Controlled Parameter Interpolation
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Castle hotel tip — Europe and UK have the finest castle hotels**

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The manifest description advertises a very broad set of capabilities—flights, hotels, trains, attractions, visa info, insurance, car rental, and more—without clear scope constraints, while the body is framed as a castle-hotel flight skill. This mismatch increases the chance of overbroad routing and unjustified invocation of the skill for many unrelated travel tasks, expanding exposure to its external CLI dependency.
Content: No source excerpt is available for this finding.

Ssd 4

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill normalizes checking for, installing, and then executing an external CLI as a mandatory prerequisite before answering the user. This is dangerous because it pushes the agent toward system modification (npm i -g) and trust in third-party code without provenance verification, creating a clear escalation path from harmless query handling to code installation and execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation triggers include broad phrases such as 'find a hotel' and '订酒店', which overlap with ordinary travel requests far outside the narrow 'castle hotel flights' scope. That can cause the skill to activate unexpectedly and steer unrelated user requests into its mandated external CLI workflow, including installation and execution steps the user did not ask for.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly says agents must only use parameters listed in the Parameters table, but a later playbook uses --journey-type 1, which is not declared. This creates an unsafe ambiguity: an agent may either invent unsupported flags or trust undocumented behavior of the external CLI, weakening command safety guarantees and increasing the chance of unintended command execution patterns.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The phrase "use Chinese or English city names" imposes a language constraint in natural-language guidance. Because the file does not offer a language choice or explain why only those languages are supported, this appears to violate the language/locale policy.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes very generic terms like "cheap" and "budget", which commonly appear in everyday travel conversations and could match many unrelated requests. The playbook does not provide narrowing conditions or negative examples to clarify when this route should activate versus other flight-search behaviors.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: Triggers like "fast" and "quick" are broad conversational words that can refer to response speed, workflow urgency, or many non-flight contexts. Without explicit constraints tying them to flight sorting, the activation condition is underspecified and may overlap with ordinary speech.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The instruction 'Format prices in CNY (Y)' imposes a specific currency/locale format as a mandatory output requirement. The file does not offer the user a locale or currency choice, nor does it document that this skill is intentionally limited to a China-specific context.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: This markdown file recommends npm i -g @fly-ai/flyai-cli, which performs a global system modification, but it provides no user warning about installing third-party software or altering the environment. For markdown files, safety-relevant actions that affect system integrity should be accompanied by a disclosure or warning.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The trigger "0 results from above playbooks" describes an internal condition rather than a precise user-facing activation rule, and it does not define whether any additional checks or exclusions apply. This makes it unclear exactly when the fallback should run and when it should not.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest describes a skill for castle hotels, heritage stays, flight booking, hotel reservations, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. This file's SOP and output template only describe collecting flight parameters, mapping them to flight-search CLI flags, and rendering flight search results, which is materially narrower than the claimed scope.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.