Security audit

Concert Event Tickets

Security checks for vulnerabilities and agentic risk

Overview

This ticket-search skill is mostly coherent, but it asks agents to install and run an unpinned global CLI and keep hidden local logs of raw user queries.

Review before installing. Only use this skill if you are comfortable with a third-party flyai/Fliggy CLI handling your searches, booking links appearing in results, a global npm package being installed after explicit approval, and local execution logs being disabled or cleaned up unless you intentionally want them retained.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Agent Behavior Hijacking Through Mandatory External-Service and Advertising Instructions
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:55
Finding: Unpinned Global Installation and Execution of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistent Logging of Raw User Queries and Command History
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record the user's raw input, collected parameters, complete CLI commands, recovery commands, and execution metadata. It states that this logging is internal and not shown to users, while also providing a persistence command that appends the information to a hidden file. No user consent, minimization policy, redaction procedure, retention period, deletion mechanism, file-permission requirement, or access-control po ...[truncated 2663 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-poi --city-name "Shanghai" --category "演出赛事"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to automatically install a global npm package if the CLI is missing, which modifies the host environment without explicit user consent. In an agent context, this creates a supply-chain and system-integrity risk because arbitrary package installation can execute lifecycle scripts and persist software on the machine.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation list includes the standalone term "performance," which is broad and can refer to many everyday contexts such as job performance, software performance, or general evaluations. The file provides only one negative example, so the trigger scope is not constrained enough to avoid unintended invocation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prerequisites section normalizes a global npm i -g install without any safety notice, encouraging an agent to alter the system as part of routine use. Global package installation expands the blast radius of a compromised package or typo-squatted dependency and can affect future sessions beyond the current task.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This workflow explicitly tells the agent to detect a missing command and then install software automatically before continuing. That pattern is dangerous in autonomous execution because it combines environment probing with immediate system modification, increasing the likelihood of unauthorized changes and exposure to malicious or compromised dependencies.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The playbook embeds the category value "演出赛事" directly in the command while the surrounding document is in English, indicating a fixed locale/language choice. Because the file does not state that the skill is region-specific or offer any user language/locale choice, this can violate language/locale policy expectations.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The command uses the fixed category value "体育场馆", which imposes a specific language/locale in the skill behavior. The file does not explain a regional constraint or provide an opt-in mechanism for users who may expect categories in another language.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 85% confidence
Finding: The command fixes the category to "剧院剧场", creating a locale-specific behavior without any accompanying justification or user choice. Under the stated policy, forcing a specific language/locale is a concern unless clearly documented or optional.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs raw user input, CLI commands, and operational details, and then persists that data to a local file without any stated minimization, redaction, retention, or user notice. In a travel and ticketing skill, user queries may contain personal, financial, or itinerary information, so persistent internal logging increases privacy, compliance, and data exposure risk if logs are accessed, mishandled, or exfiltrated.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema includes a user_query field populated with the raw input, meaning any secrets, personal travel details, names, booking references, or payment-related text entered by the user may be retained internally. Because this skill handles ticketing and travel-adjacent tasks, the context makes such collection more sensitive than a generic utility skill.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs appending execution logs to .flyai-execution-log.json, creating durable storage of internal activity that may include user-provided data and command history. Persistent flat-file logging is dangerous because it can silently accumulate sensitive data, be copied in backups, or become readable by other processes or operators without a clear need-to-know boundary.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Line L135 says both 'Use detailUrl for booking links' and 'Never use detailUrl' in the same rule. This is an internal contradiction in the skill's documentation about the core output behavior, making the stated intent unclear.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.