Security audit

Early Flights

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is coherent, but it asks for broad local execution and can persist raw travel queries in a hidden local log.

Install only if you trust the flyai CLI and are comfortable with an agent running travel searches through that provider. Prefer installing the CLI yourself without sudo, review or disable .flyai-execution-log.json logging, and avoid entering passport, payment, booking-reference, or other sensitive personal details unless you know how they will be handled.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (4)

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The fallback cases are underspecified and overlap in ways that can cause the agent to choose an unsafe or incorrect recovery path. In particular, instructions like auto-searching tomorrow for an invalid or past date, broad keyword search, and loosely defined retries can trigger actions the user did not explicitly authorize, increasing the risk of unintended bookings, misleading results, or policy bypass during failure handling.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "earliest" is broad enough to match many ordinary travel or itinerary requests that are not explicitly asking for a flight search, which can cause the skill to activate outside its intended scope. Because the playbook is wired to execute a CLI flight-search command rather than just provide informational guidance, this increases the risk of incorrect tool use, parameter mapping on ambiguous input, and unintended external queries.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The runbook explicitly logs the raw user query in an internal execution log, which can capture sensitive personal, financial, travel, or identity data without any notice, minimization, or retention controls. In a travel skill, user queries may contain passport details, booking references, dates, locations, and other high-sensitivity information, making silent collection materially risky if logs are accessed, reused, or leaked.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of operational and potentially sensitive user-derived data without any privacy warning, retention limit, encryption, or access restriction. Persistent logging increases the blast radius of any compromise because historical requests and metadata can be harvested long after the original interaction.

Static analysis

No suspicious patterns detected.