Security audit

explore-france

Security checks for vulnerabilities and agentic risk

Overview

This France travel skill is relevant to flight search, but it tells agents to automatically install an unpinned global CLI and has broad activation rules that deserve review before use.

Install only if you are comfortable with a travel skill that may query the flyai/Fliggy service with your route and date details. Do not allow automatic global installation of the CLI; install any dependency only after reviewing the package, preferably pinned and in a local or sandboxed environment. Verify all booking links and prices before purchasing.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Intent-Code Divergence

Medium

Confidence: 94% confidence
Finding: The skill explicitly states that only parameters listed in the Parameters Table may be used, but Playbook D invokes `--journey-type 1`, which is not declared there. This kind of contract mismatch can cause agents to ignore their own safety/validation rules, invent unsupported flags, or execute commands that were not properly reviewed, increasing the chance of unintended behavior.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: The fallback guidance tells the agent/operator to install and rely on a globally installed CLI (`npm i -g @fly-ai/flyai-cli`) to recover from failure, which expands the skill's operational scope beyond ordinary travel-booking behavior. Installing global packages introduces supply-chain and environment-modification risk, and if an agent follows these instructions automatically it could execute untrusted tooling on the host system.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger term `discover` is overly generic and can match many unrelated user requests, causing the skill to activate outside its intended travel-booking context. In an agent environment, unintended activation can lead to unnecessary command execution, parameter collection, or even package installation pathways for benign conversations.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to install `flyai-cli` if it is missing, which authorizes a system-modifying global npm install without explicit user consent. Allowing a skill to unilaterally install software expands the attack surface, can alter the host environment, and may expose the system to supply-chain risk from the package registry.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The fallback workflow includes `npm i -g @fly-ai/flyai-cli`, a global package installation that changes the system state and trusts an external package source at runtime. Because this occurs as part of normal error handling, an agent may execute it automatically, making the behavior especially risky in unattended or privileged environments.

Vague Triggers

Medium

Confidence: 84% confidence
Finding: The trigger set for the cheapest-option playbook includes very generic terms like 'cheap' and 'budget', which are common in ordinary travel conversations and can cause unintended activation. In an agent skill that executes booking-related commands, overly broad routing can lead to the wrong search logic being applied, producing misleading results or causing actions inconsistent with the user's actual intent.

Vague Triggers

Medium

Confidence: 80% confidence
Finding: The phrases 'fast' and 'quick' are too vague to reliably indicate a request for the fastest flight route, since they may refer to response speed, booking process, or general urgency rather than itinerary optimization. This ambiguity increases the chance of misrouting user requests and returning travel options that do not match the user's intent, which is risky in a transactional travel-booking context.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The fallback condition '0 results from above playbooks' is ambiguous and lacks clear invocation boundaries, making it easier for the system to enter a broad search path unexpectedly. Because the fallback performs both a structured flight search and a keyword search, an imprecise activation condition can expand scope beyond the original request and increase the likelihood of irrelevant or unintended downstream behavior.

Static analysis

No suspicious patterns detected.