Security audit

Explore Dubai

Security checks for vulnerabilities and agentic risk

Overview

This Dubai travel skill is coherent with booking searches, but it asks agents to auto-install an unpinned global CLI and keep hidden raw-query logs.

Install only if you are comfortable with a provider-specific travel booking workflow. Do not let an agent auto-run the global npm install; review and install the flyai CLI manually from a trusted source, preferably pinned or isolated. Treat the local execution log as sensitive because it may retain travel details and raw prompts.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:127
Finding: Automatic Global Installation of an Unpinned npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Hidden Raw Query Logging with Unsafe Shell Interpolation Pattern
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the complete raw user query, collected parameters, executed commands, and fallback commands in `.flyai-execution-log.json`. It explicitly states that this internal logging is not shown to users, but it provides no consent mechanism, redaction policy, retention limit, file-permission requirement, or secure deletion process. Travel requests may contain names, dates, locations, itinerary details, budgets, or other pers ...[truncated 2504 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Dubai" --dep-date 2026-01-15 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 93% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package/version, which can cause execution of whatever package version is currently resolved from the registry. If the upstream package is compromised, typosquatted, or updated maliciously, users installing the skill could execute untrusted code during setup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to install a global npm package when the CLI is unavailable, which modifies the user's system without prior informed consent. Installing and executing a third-party CLI expands the attack surface to package-supply-chain compromise, postinstall scripts, and unintended environment changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The prerequisites section normalizes running npm i -g @fly-ai/flyai-cli without any warning that it will alter the host environment and trust code from the npm ecosystem. In an agent setting, this can lead to silent installation and execution of unreviewed code on the user's machine.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The workflow mandates fallback to automatic installation when flyai is missing, creating a direct path from a user travel query to a privileged system-modifying command. This is dangerous because the agent is being instructed to remediate missing tooling by executing network-fetched code rather than stopping and requesting approval.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records raw user input, full CLI commands, and operational metadata in an internal execution log without any notice, minimization, or retention controls. In a travel-booking skill, user queries and commands can contain sensitive personal, financial, or itinerary data, so persistent logging increases privacy exposure and the blast radius of any local compromise or log access.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema includes a user_query field containing raw input, which creates direct retention of unfiltered user-provided content. Because this skill supports travel services such as flights, hotels, visas, and insurance, raw queries may include passport details, contact information, dates, booking references, or other sensitive data that should not be persistently stored without strong safeguards.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The persistence step appends the generated execution log to a local file, causing ongoing accumulation of user-derived content and command history. Persistent local logs are easy to overlook, may be insufficiently protected, and can expose sensitive travel or identity-related information if the host, workspace, backups, or downstream tooling are accessed by unauthorized parties.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.