ClawHub
Back to skill

Security audit

explore-malaysia

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is not clearly malicious, but it asks agents to globally install and run a third-party travel CLI without a clear user approval step.

Install only if you are comfortable with an agent installing `@fly-ai/flyai-cli` globally and running it for travel searches. Prefer manually reviewing and installing the CLI yourself, avoid granting elevated privileges unless necessary, and verify any returned booking links before entering payment or personal travel details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (5)

Description-Behavior Mismatch

Medium
Confidence
91% confidence
Finding
The manifest advertises broad travel capabilities such as hotels, visas, insurance, car rental, and attraction tickets, but the documented implementation only supports flight-search CLI flows. This mismatch can cause an agent or user to rely on unsupported functionality, leading to unsafe fallbacks, fabricated answers, or unintended behavior outside the validated flow.

Intent-Code Divergence

Medium
Confidence
97% confidence
Finding
The skill explicitly forbids inventing CLI parameters, yet the direct-route playbook uses `--journey-type 1`, which is not listed in the Parameters table. This inconsistency can cause agents to execute undocumented options, increasing the risk of command misuse, unexpected behavior, or reliance on unvalidated functionality.

Vague Triggers

Medium
Confidence
86% confidence
Finding
Using a broad trigger like `discover` can cause the skill to activate on generic travel or exploratory conversations that are not specifically about Malaysia flight booking. In an agent setting, overbroad activation increases the chance of unnecessary command execution, external queries, and user confusion about why this skill took control.

Missing User Warnings

Medium
Confidence
98% confidence
Finding
The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` automatically if the CLI is missing, without warning the user that it will modify the system environment. Silent global installation is dangerous because it changes the host state, may require elevated privileges, and pulls executable code from an external registry.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill description and execution rules do not clearly disclose that using the skill may execute shell commands and query external services through the `flyai` CLI. Lack of disclosure undermines informed consent and makes it more likely an agent will perform networked or state-changing actions unexpectedly.

Static analysis

No suspicious patterns detected.