Security audit

Explore Bali

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent travel-booking helper, but it tells agents to install an unpinned global npm CLI automatically and persist raw user travel queries in a hidden local log.

Review carefully before installing. This skill may contact third-party travel services, produce booking links, install a global npm package, and store raw travel requests locally. Prefer manual, pinned, reviewed installation of the CLI and disable or remove the execution log before using it with personal travel details.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:122
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:7
Finding: Raw User Query Persistence and Shell Injection Risk in Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook records `{raw input}` directly in a persistent hidden file and states that the log is maintained internally rather than shown to users. No consent, redaction, retention period, file permission, encryption, or cleanup policy is defined. Travel queries can contain personal information such as travel dates, origin and destination, accommodation preferences, budget, or other identifying context. Persisting the complete query creates a plaintext local data-retention risk. The proposed shell command also places generated JSON inside a single-quoted shell argument. JS ...[truncated 2294 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This workflow explicitly mandates automatic installation of @fly-ai/flyai-cli whenever the command is missing, without warning or approval. That is more dangerous than a passive prerequisite because it turns missing tooling into an autonomous package installation action, creating clear supply-chain and host-modification risk in environments where agents can execute commands.
Content: No source excerpt is available for this finding.

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Bali" --dep-date 2026-06-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version, which can cause execution of whatever package version is current at install time. If the upstream package, dependency chain, or registry resolution is compromised, users could run unreviewed code during installation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The skill frames itself as a mandatory CLI executor and directs installation of a global npm package without any warning, consent, or least-privilege guidance. In an agent context, this can cause unreviewed system modification and supply-chain exposure if the package is malicious, compromised, or unexpectedly executes install-time scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The prerequisites section presents a global install command as a routine setup step but omits a user-facing warning that it modifies the host environment. This increases the chance an agent or user will perform a privileged, persistent change without understanding the security implications.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs user_query as raw input in an internal execution record, which can capture sensitive personal, financial, passport, visa, or travel details. In a travel-booking skill, users are especially likely to provide high-sensitivity data, so retaining raw queries without clear minimization, consent, or retention controls creates a real privacy and data-exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file, but does not define encryption, file permissions, retention limits, or restrictions on what data may be written. Because the same runbook also includes raw user input and command history, local persistence increases the chance of unintended disclosure through shared environments, backups, debugging artifacts, or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This markdown file says the skill 'wraps the flyai-cli to provide real-time travel data with booking links,' which implies outbound network access and interaction with third-party services. The description does not include any user-facing warning about contacting external services or sharing travel query data, which is relevant for privacy and system-awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.