Security audit

explore-indonesia

Security checks for vulnerabilities and agentic risk

Overview

This Indonesia travel skill is not clearly malicious, but it tells agents to automatically install and run an unpinned global travel CLI, which changes the user's system without clear approval.

Install only if you trust the `@fly-ai/flyai-cli` package and are comfortable with an agent running live travel-search commands. Require explicit approval before any `npm i -g` command, prefer a pinned local or sandboxed install, and verify booking links before entering payment or personal details.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to install a global npm package if the CLI is missing, which expands behavior from answering travel requests into modifying the host environment. This is dangerous because it introduces supply-chain and arbitrary code execution risk from an external package without user approval or any trust verification.

Intent-Code Divergence

High

Confidence: 91% confidence
Finding: The skill says agents must never invent CLI parameters, yet later uses `--journey-type 1`, which is not declared in the parameters table. This inconsistency can cause agents to execute unsupported commands, creating unreliable behavior and potentially encouraging unsafe trial-and-error with external tooling.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The workflow directs the agent to globally install software automatically, without notifying the user or requesting consent. That is risky because installation changes the system state and may execute untrusted post-install scripts from the package ecosystem.

Missing User Warnings

Low

Confidence: 82% confidence
Finding: The skill strongly requires external CLI execution for all answers but does not clearly warn users that their queries may trigger local command execution and outbound data fetching. In this context, the omission weakens informed consent and trust boundaries, though the primary risk is transparency rather than direct exploitation.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The fallback condition '0 results from above playbooks' is underspecified, which can lead to inconsistent activation of a broader search path. In an agent setting, ambiguous fallback logic can cause unintended tool invocation and broader keyword searches than the user expected, increasing the chance of irrelevant actions, prompt-manipulation exposure from search results, or bypass of stricter routing constraints.

Ssd 4

Medium

Confidence: 93% confidence
Finding: The skill normalizes a pattern of checking for a tool and then installing and running it before answering, which pushes the agent toward executing external software as the default path. This reduces friction around risky actions and can lead to unintended execution in environments where the tool has not been vetted.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The environment-check section explicitly escalates from `flyai --version` to `npm i -g @fly-ai/flyai-cli` as the default failure path. This creates an incremental permission-escalation workflow that can expose the host to package compromise, malicious install scripts, or policy violations without a distinct authorization step.

Static analysis

No suspicious patterns detected.