Security audit

Early Flights

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is purpose-aligned overall, but it asks agents to install and run an unpinned external CLI globally, includes a sudo fallback, and persists raw user queries in a risky shell-based log.

Review before installing. Use only in a sandbox or low-privilege environment, avoid sudo, pin and verify the flyai CLI, and do not enable the execution-log persistence unless raw user queries are redacted and written through a safe filesystem API. Expect results to route through flyai/Fliggy booking links rather than neutral multi-provider search.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Forced Commercial Output Through Skill Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:37
Finding: Unpinned Global Installation and Execution of a Third-Party CLI
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/fallbacks.md:5
Finding: Root-Level Installation of an Unpinned NPM Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:34
Finding: Shell Command Injection in Execution-Log Persistence
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook places `{raw input}` inside generated JSON and then interpolates the complete JSON document into a single-quoted shell command. A single quote contained in user input can terminate the shell string. Subsequent attacker-controlled shell syntax can then be interpreted as commands rather than log data. The template also does not describe JSON escaping. Quotes, backslashes, and control characters in user input can corrupt the log even when they do not achieve shell execution. In addition, raw travel queries are persisted without data minimization, access-control guidance, retention limits, or user consent. ### Attack Path 1. A user submits a travel query containing a single quote followed by shell syntax. 2. The raw query is placed in the `user_query` field without de ...[truncated 963 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 151)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Beijing" --dep-date 2026-05-01 --dep-hour-start 5 --dep-hour-end 9 --sort-type 6

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/early-flights, which references mutable remote content (main) and relies on npx without a pinned version. This can expose users to supply-chain risk if the package resolution or referenced repository content changes, causing installation of unexpected code or a tampered skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The fallback instructs operators to globally install a package and then escalate to sudo if it fails, without warning about the risks of running package installation as root. If followed, this could grant a third-party package install script full system privileges, leading to host compromise or unsafe system-wide changes in environments where the CLI or dependency source is tampered with.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The explicit suggestion to run sudo npm i -g executes package installation with root privileges, which is dangerous because npm lifecycle scripts and dependencies can execute code during install. In the context of an agent skill, embedding privileged shell guidance increases the chance that an automated or semi-automated operator will perform unsafe root-level actions on the host.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The manifest centers this skill on finding the earliest departing flights of the day, sorted by departure time. In this fallback document, the workflow expands into generic keyword travel search and even suggests rail alternatives, which goes beyond the primary described behavior of early-flight discovery.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation first instructs the agent not to search when the date has passed, then immediately instructs it to auto-search tomorrow. Those two directives conflict on whether a search should occur, creating intent ambiguity in the documented behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes the single word "earliest", which is a broad everyday term rather than a narrowly scoped invocation phrase. The file does not provide negative examples or additional constraints to clarify when this playbook should activate versus other flight-related intents.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook schema explicitly includes user_query as raw input in an internal execution log, which can capture personal data, travel details, contact information, or payment-related text users may provide during booking flows. Because the document says the log is not shown to users and provides no notice, consent, minimization, or retention limits, this creates a privacy and compliance risk if logs are stored, accessed, or exfiltrated.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file, which turns the previously defined sensitive log contents into persistent at-rest data without any user warning. In a travel skill context, persisted logs may contain itinerary details, identifiers, and other sensitive booking-related inputs, increasing exposure through local compromise, backups, multi-user systems, or accidental inclusion in artifacts.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 83% confidence
Finding: The file defines trigger phrases in both English and Chinese, including "最早" and "10点前到", but does not explain whether multilingual behavior is user-selectable or context-dependent. This can create an implicit language policy or locale assumption without documented opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.