Security audit

Explore Europe

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is mostly purpose-aligned, but it asks the agent to install and run an unpinned global CLI and to persist raw user-query logs in a risky way.

Install only if you are comfortable with a travel skill that depends on flyai booking data, may install a global npm CLI, and may write local execution logs containing your travel query. Prefer manually installing a pinned, reviewed CLI version and disable or avoid raw query logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:122
Finding: Automatic Installation and Execution of an Unpinned Third-Party CLI
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:33
Finding: Shell Command Injection Through Raw Query Logging Template
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging schema places `{raw input}` inside generated JSON and then interpolates the complete JSON value into a single-quoted shell command. JSON escaping does not provide shell escaping. In particular, a single quote contained in the user's query can terminate the shell's quoted string. If an implementation follows this template literally, shell metacharacters after the terminating quote can be interpreted as commands. The redirection also persistently records raw user queries and execution metadata in a hidden local file without specifying consent, data minimization, permissions, rotation, or retention controls. The exploitability is conditional on the Agent constructing and executing the documented shell command through a shell. Using a structured file-writing API without shell interpolation ...[truncated 1312 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Paris" --dep-date 2026-06-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package/version, which can cause execution of whatever package/version npx resolves at install time. If the referenced package, dependency chain, or namespace is compromised, users may execute attacker-controlled code during setup, making this a real supply-chain risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly directs the agent to install a global npm package if the CLI is missing, which changes the host environment without user confirmation. Automatic package installation introduces supply-chain and system-integrity risk, especially because the package is third-party and the instruction is framed as mandatory.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prerequisites section includes a global npm install command without warning that it modifies the user's system. Even as documentation, embedding this as a prerequisite for normal skill execution encourages silent environment changes and increases exposure to malicious or compromised packages.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The workflow mandates attempting installation automatically after a failed version check, making system modification part of the normal execution path. This is more dangerous than a passive prerequisite because it operationalizes unapproved code installation at runtime and could be abused to run untrusted packages on the host.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "Europe trip" is very broad and likely to match many ordinary travel-related user requests, causing this playbook to activate in situations beyond its intended scope. In a skill that supports bookings and travel actions, overbroad routing can lead to inappropriate parameter mapping, unintended downstream actions, or responses constrained by the wrong workflow.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The trigger phrase "cheap Europe trip" is also broad and can match a wide range of generic budget-travel requests, making the playbook prone to accidental invocation. Because the skill supports transactional travel functions such as flights, hotels, and rail passes, misrouting budget-related queries into a fixed playbook can produce unsuitable recommendations or trigger booking-oriented flows without sufficient user specificity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The schema explicitly stores user_query as raw input, which can contain personal data, payment/travel details, or other sensitive information. Persisting raw queries without minimization, consent notice, retention controls, or redaction increases the risk of privacy violations and secondary exposure if logs are accessed or leaked.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of potentially sensitive operational and user data. Without safeguards such as encryption, access restrictions, retention limits, and disclosure, this can lead to unauthorized local disclosure or long-term accumulation of sensitive information.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: Line L03 states that the agent maintains this log internally and that it is not shown to users. However, line L31 explicitly says that risk_flags from that log must be rendered as '⚠️ Note:' in user-facing output, which directly contradicts the earlier documentation about the log being internal-only.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest says the skill is 'powered by Fliggy (Alibaba Group)', but the user-facing template hardcodes 'Powered by flyai' instead. This creates a semantic mismatch between the claimed service backing the skill and what the documentation suggests users are interacting with.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The 'Next steps' section presents 'flyai --version' under 'Check network', but a version command does not actually verify network connectivity. This is an intent-documentation contradiction in the template's inline guidance, because the prescribed action does not do what the text claims.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.