T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:11- Finding
Agent Role and Commercial Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
coastal-flight
Security checks for vulnerabilities and agentic risk
Overview
The skill is a plausible travel-search helper, but it asks agents to install an unpinned global CLI, run interpolated shell commands, and persist raw travel queries without clear user control.
Review before installing. Only use this skill in an environment where you are comfortable installing and running the flyai CLI, and require explicit approval before any global npm install or filesystem logging. Do not enter sensitive personal, payment, passport, visa, or account details unless the logging behavior is removed or clearly controlled.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (4)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:72- Finding
Automatic Global Installation of an Unpinned npm Package
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:95- Finding
Shell Command Injection Through User-Controlled Travel Parameters
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
references/runbook.md:7- Finding
Unsafe Persistent Logging of Raw User Queries and Commands
- Content
View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The runbook instructs the Agent to store the complete raw user query, collected parameters, CLI commands, and fallback commands in a persistent local file. Travel queries can reveal locations, dates, budgets, intended movements, and other personal information. Users may also accidentally include credentials or unrelated sensitive content. No redaction policy, retention period, access-control requirement, encryption requirement, opt-in consent, or secure deletion process is defined. The persistence example also em ...[truncated 1834 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (11)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
flyai search-flight --origin "Beijing" --destination "Qingdao" --dep-date 2026-08-01 --sort-type 2
text ## Output Rules 1. **Conclusion first** — lead with best coastal route option 2. **Coastal tip** — suggest best seasons for seaside travel
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill explicitly instructs the agent to install a global npm package if the CLI is missing, with no requirement for user consent or warning about modifying the system. In an agent setting, automatic package installation expands the trust boundary to the npm supply chain and can execute untrusted install scripts, creating avoidable code-execution and persistence risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The prerequisite flow tells the agent to run
npm i -g @fly-ai/flyai-cliafter a failed version check, again without confirmation or sandboxing guidance. Global installation is especially risky because it alters the host environment and may run arbitrary post-install scripts from the package ecosystem.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The trigger list includes "coastal flight," which is a generic travel phrase that could easily appear in ordinary conversation rather than as an intentional skill invocation. The file does not provide exclusion conditions or negative examples to clarify when this playbook should or should not activate.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The condition "Playbook A/B/C returns 0 results" does not specify whether all three playbooks must be attempted first or whether zero results from any one of them is sufficient. This ambiguity can lead to inconsistent or unintended activation of the fallback behavior.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The runbook explicitly captures
user_queryas raw input in an internal execution log, which can contain personal data, travel details, contact information, or payment-related text entered by users. For a travel-booking skill, retaining full raw queries is broader than necessary for core functionality and creates unnecessary privacy and data-exposure risk, especially if logs are later accessed, exported, or combined with other telemetry.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The schema records raw user input internally while the runbook provides no user-facing disclosure or warning about that collection. In this context, users may submit sensitive itinerary, identity, or visa-related details, so undisclosed retention undermines transparency and can create compliance and trust issues in addition to the direct privacy risk.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The runbook describes persistent file logging but does not pair that behavior with any warning about retention, storage location, or data handling. Because this is a travel skill that may process multi-service booking details, silent persistence makes the issue more dangerous by enabling long-lived accumulation of sensitive operational and user context.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The template and failure guidance reference a generic 'flyai' CLI and branding instead of the declared Fliggy-powered coastal-flight skill, creating a trust-boundary mismatch between the manifest and runtime instructions. This can mislead the agent or user into invoking the wrong tool, exposing data to an unintended backend or producing results from an unauthorized integration.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 78% confidence
- Finding
The playbook hard-codes English and Chinese trigger phrases but does not indicate that users may choose their preferred language or locale. This can violate language-choice policy when a skill implicitly assumes supported languages without documenting opt-in or alternatives.
- Content
Context-Inappropriate Capability
Low
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The runbook instructs appending execution logs to a local file, creating persistent storage of operational and potentially user-derived data without showing a clear business need for this skill. Persistent local logs increase the attack surface by leaving data on disk where it may be read by other processes, included in backups, or retained indefinitely.
- Content
Static analysis
No suspicious patterns detected.