Security audit

Explore Maldives

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it asks the agent to install and run an unpinned CLI, force booking-link output, and keep hidden raw-query logs.

Review this skill before installing. It may install a global npm CLI, send travel details through flyai/booking services, prioritize booking links, and write hidden local logs containing raw queries. Prefer a pinned CLI version, explicit consent before external calls, and disabled or redacted logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Promotional Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Automatic Installation of Unpinned Executable Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:1
Finding: Hidden Raw-Query Logging Through Unsafe Shell Interpolation
Content: View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The runbook directs the Agent to retain the user's raw input and execution metadata in `.flyai-execution-log.json` while explicitly stating that the internal log is not shown to users. This creates undisclosed local retention of potentially sensitive travel details. The proposed implementation inserts generated JSON into a single-quoted shell command. Raw user input can contain an apostrophe, shell metacharacters, command substitutions, or newlines. If the template is substituted literally, an apostrophe can terminate the shell's single-quoted string and allow the remainder of the user-controlled content to be interpreted as shell syntax. JSON escaping does not provide shell escaping and therefore does not prevent this vulnerability. ### Attack Path 1. An attacker supplies a travel query containing ...[truncated 1045 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Male" --dep-date 2026-02-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 95% confidence
Finding: The README instructs users to run npx skills add ... without pinning an exact version or immutable reference. This can cause users to fetch and execute changed upstream code later, creating a supply-chain risk if the package or referenced content is updated maliciously or compromised.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation section triggers on terms like "Maldives" and "island paradise," which can appear in ordinary travel discussion that is not necessarily asking to invoke this skill. The section provides only one negative example and does not clearly define narrower intent conditions or more complete exclusions, increasing the chance of unintended activation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, but provides no notice, minimization, or redaction guidance. In a travel-booking skill, user queries may contain names, passport details, dates, contact info, or payment-related context, so retaining raw input creates an avoidable privacy and data-handling risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the schema captures raw user_query data and the persistence section writes the resulting execution log to .flyai-execution-log.json, creating durable storage of potentially sensitive travel and booking information. In this skill's context, users are likely to share itinerary details, identity data, visa questions, and booking preferences, so persistent raw logging materially increases privacy, compliance, and secondary-exposure risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The log persistence step appends execution data to a local file without any warning, consent model, or safeguards around what is being written. Because the same log schema includes raw user input and command history, persisting it locally increases the chance of unintended disclosure to other processes, users, backups, or support workflows.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The manifest emphasizes a Maldives escape planner experience, while the README says the skill wraps flyai-cli to provide real-time travel data with booking links. That introduces transactional travel-booking functionality beyond the core destination-planning description, creating a mild description/behavior mismatch.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The README advertises real-time travel data and booking links but does not disclose that user queries may be sent to external services or that interactions may lead to third-party booking flows. In a travel-booking context this increases privacy and consent risk, especially if users share itinerary details, dates, names, or destination preferences assuming the skill is purely local.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.