Back to skill

Security audit

explore-malaysia

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is not clearly malicious, but it asks agents to auto-install a global third-party CLI and tightly routes answers through commercial booking links without enough user control.

Install only if you are comfortable with a skill that can install a global npm CLI and send flight-search details to a third-party service. Prefer approving installation manually, using an isolated environment, and treating the booking links and FlyAI branding as commercial output rather than neutral travel advice.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:10
Finding

Mandatory Commercial Output and Agent Behavior Hijacking

Content
View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` The output rules reinforce this behavior: ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Malaysia tip — visa-free for Chinese citizens 2024+; KL is main hub** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` The referenced output template imposes the same commercial content: ```markdown ## Output Template ```markdown ## Flight Search Results | # | Airline | Route | Departure | Duration | Price | | |---|---------|-------|-----------|----------|-------|-| | 1 | {airlineName} | {origin} -> {destination} | {depTime} | {duration} | Y{price} | [Book]({{detailUrl}}) | Powered by flyai - Real-time pricing, click to book ``` ## Notes - Always include [Book](detailUrl) links - Format prices in CNY (Y) - Include ...[truncated 2365 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:66
Finding

Unpinned Global Installation of a Third-Party npm Package

Content
View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` Still fails -> **STOP.** Do NOT continue. Do NOT use training data. ``` The fallback instructions repeat the installation requirement: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ **NEVER proceed without CLI. NEVER fabricate results.** ``` ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The Skill mandates installation of `@fly-ai/flyai-cli` from the npm registry without specifying an exact version. It provides no lockfile, integrity hash, signature check, package provenance validation, or review of npm lifecycle scripts. Because the version is not pinned, the effective code installed by the Skill can change after the Skill itself has been audited. A compromised maintainer account, malicious future release, registry compromise, or unexpected package change could therefore introduce code that was not present during this review. The use of `-g` installs the package into the global npm prefix rather than an isolated project environment. This expands the change beyond the Skill's project directory and may alter commands available to other sessions or applications. npm package installation can also execute package lifecycle scripts with the permissions of the account running npm. No evidence in the audited files proves that the named package is currently mali ...[truncated 1585 chars]
Remediation
View remediation
`. 4. Record and verify the expected package integrity hash and provenance. 5. Use a project-local, isolated dependency installation instead of `npm -g`. 6. Commit a lockfile where applicable and use deterministic installation such as `npm ci`. 7. Disable npm lifecycle scripts during installation when the package can function without them, or audit every required lifecycle script before execution. 8. Run the CLI in a sandbox or container with minimal filesystem, environment, and network permissions. 9. Verify the executable path and package identity before invoking `flyai`. 10. If the dependency is unavailable, stop safely and explain the missing prerequisite rather than modifying the environment automatically. 11. Establish a controlled dependency-update process so each new package version is reviewed before use. ]]>
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text

## Output Rules

1. **Conclusion first** — lead with best option
2. **Malaysia tip — visa-free for Chinese citizens 2024+; KL is main hub**

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest advertises broad travel capabilities such as hotels, trains, visas, insurance, and car rental, but the implementation only documents flight search via the flyai CLI. This mismatch can mislead users and calling agents into invoking the skill for unsupported workflows, causing incorrect delegation, broken expectations, and possible unsafe handling if the agent improvises outside the documented capability.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The workflow requires sending user itinerary details such as origin, destination, and dates to an external CLI-backed service, but it provides no privacy notice or consent step. In agent settings, this can expose personal travel plans and metadata to third parties without the transparency users would reasonably expect.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill directs the agent to run npm i -g @fly-ai/flyai-cli automatically if the tool is missing, which modifies the host environment without explicit user approval. Auto-installing a global package expands the trust boundary to external package registries and can enable supply-chain compromise, persistence, or unintended system changes in sensitive execution environments.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The skill states that only parameters listed in the Parameters Table may be used, yet a later playbook uses an unlisted --journey-type flag. This internal contradiction undermines safe command construction rules and can cause agents to either invent unsupported flags or ignore the stated restriction, increasing the risk of execution errors or unintended CLI behavior.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very common words like "cheap" and "budget" without any flight-specific context or exclusion conditions. These phrases overlap with everyday speech and could activate the playbook in unrelated conversations about cost-saving rather than flight search intent.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The triggers "fast" and "quick" are broad everyday terms that do not clearly indicate a flight-search request. Without flight-specific wording or activation boundaries, the skill may match unrelated user requests where speed is mentioned incidentally.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The instruction to always format prices in CNY imposes a specific locale/currency convention in natural-language guidance without offering user opt-in or explaining that the skill is region-specific. This can violate language/locale policy expectations when used for users outside that locale.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
88% confidence
Finding

Across the trigger definitions, the skill only presents English and Chinese phrases, which implies a fixed language scope without any stated opt-in or justification. This can conflict with language/locale policy expectations when the skill is not explicitly documented as limited to those languages or region-specific use.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

The condition "0 results from above playbooks" describes an internal outcome but does not clearly specify how or when this fallback should be selected in practice. It leaves uncertainty about whether the fallback is automatic, user-visible, or limited to particular failed searches.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest says the skill is powered by Fliggy (Alibaba Group), but the template instructs the skill to present results as 'Powered by flyai'. This is an active documentation-level contradiction about the service identity presented to users, which can misrepresent the skill's actual backing provider.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.