Security audit

castle-hotel

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it can make persistent system changes and send travel details through a third-party CLI without clear consent or scoping.

Install only if you trust the flyai npm package and are comfortable with the agent running travel-search commands that may contact an external service. Review or perform any npm installation yourself, preferably in a controlled environment, and confirm booking links and provider identity before using them.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Description-Behavior Mismatch

Medium

Confidence: 93% confidence
Finding: The manifest markets a broad set of travel capabilities, but the actual workflow only defines flight-search behavior through the flyai CLI. This mismatch can cause the agent to activate the skill for unsupported tasks and then follow misleading instructions, increasing the chance of incorrect handling, unsafe fallback behavior, or unintended external calls.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill explicitly says agents must only use listed parameters, yet a playbook later requires an undocumented --journey-type flag. This contradiction creates ambiguous execution rules that can lead agents to invent or trust unverified flags, undermining command safety guarantees and making misuse or unexpected CLI behavior more likely.

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The template tells the agent to present booking results as 'Powered by flyai' even though the skill metadata says the service is powered by Fliggy. In a travel-booking context, mismatched branding can mislead users about the transaction source, erode trust, and potentially facilitate phishing-style confusion around who is handling bookings and pricing.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The activation phrases include generic terms like 'find a hotel' and '订酒店', which overlap with common travel requests far beyond the niche 'castle hotel' use case. That broad matching can cause unintended activation, routing ordinary user queries into a CLI-driven workflow that may install software or send data externally without clear user intent.

Missing User Warnings

High

Confidence: 99% confidence
Finding: The skill instructs the agent to run a global npm installation when the CLI is missing, which modifies the host environment without explicit user approval. In an agent setting, this is dangerous because it can introduce unreviewed third-party code, persist changes on the system, and expand the attack surface from a simple query into package execution.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill requires executing an external CLI for user travel queries but does not disclose that origin, destination, and travel dates may be transmitted to a third-party service. This creates a privacy and consent issue because users and operators may not realize that personal itinerary data is leaving the local environment.

Static analysis

No suspicious patterns detected.