Security audit

explore-canada

Security checks for vulnerabilities and agentic risk

Overview

This Canada travel skill is mostly travel-focused, but it can make an agent install an unpinned global npm CLI without asking first.

Review before installing. Only use this skill if you are comfortable with your agent sending travel route, date, and preference data to flyai/Fliggy and installing a global npm package. Prefer installing the CLI yourself in an isolated environment, pinning or vetting the package, and requiring confirmation before any installation or booking-link action.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (5)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The template presents booking results as 'Powered by flyai' while the skill metadata says the provider is Fliggy (Alibaba Group). In a travel-booking context, provider identity affects user trust, consent, and where users believe booking links will send them, so mismatched branding can mislead users and facilitate phishing-like redirection or deceptive affiliate flows.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: Using a generic trigger like `discover` makes the skill activate on unrelated everyday requests, increasing the chance that an agent enters this workflow unexpectedly. In this skill, accidental activation is more dangerous because the workflow can proceed to CLI checks and even package installation, causing unintended command execution or system modification.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install `flyai-cli` if missing, which changes the host environment without explicit user consent. A travel-assistance skill should not silently escalate into package installation, because this can introduce unreviewed third-party code execution and persistent system changes.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The fallback path explicitly runs `npm i -g @fly-ai/flyai-cli`, a global installation that modifies the system and executes external package lifecycle code. Because this occurs as part of normal task completion rather than exceptional admin workflow, it creates a clear path from a benign user request to host modification.

Ssd 4

Medium

Confidence: 94% confidence
Finding: The workflow normalizes checking for a CLI and installing it as a routine prerequisite to answering a travel query. This is a gradual-escalation pattern: a low-risk content request becomes an instruction to alter the system and run third-party tooling, which is especially risky in autonomous agent environments.

Static analysis

No suspicious patterns detected.