Security audit

Explore Maldives

Security checks for vulnerabilities and agentic risk

Overview

This Maldives travel skill appears purpose-aligned, but it needs review because it can auto-install a global CLI and persist raw travel queries locally without clear user control.

Install only if you trust the @fly-ai/flyai-cli package and are comfortable with an agent using it for real-time travel searches. Prefer installing the CLI manually after checking the package and version, and disable or delete .flyai-execution-log.json if you do not want local records of travel queries retained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to install a global npm package if the CLI is missing, but provides no warning that this modifies the host environment and executes code from an external package registry. In an agent context, that can lead to unreviewed software installation, persistence on the system, and supply-chain exposure without informed user consent.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The prerequisite section normalizes a global npm install as a default preparation step without disclosure or confirmation. This is risky because it encourages execution of third-party code and persistent host modification simply to satisfy the skill, which is unsafe for autonomous or semi-autonomous agents.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: This workflow step directs the agent to detect a missing command and then automatically run a global installation before continuing. In practice, this enables autonomous environment modification and external code execution during normal task handling, which substantially increases risk in agent runtimes and CI/dev machines.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrase "Maldives trip" is broad enough to match many ordinary travel-related user requests, which can cause this playbook to activate when the user did not intend a fixed luxury workflow. In a booking/travel skill, overbroad activation can steer users into unintended booking flows or parameter assumptions, increasing the risk of incorrect transactions or misleading recommendations.

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger phrase "Maldives honeymoon" is ambiguous because it may overlap with general conversational requests about honeymoon ideas rather than a request to invoke this exact booking/playbook flow. In a travel commerce context, that ambiguity can lead to premature execution of a specific itinerary or package logic without sufficient user confirmation.

Vague Triggers

Medium

Confidence: 83% confidence
Finding: The trigger phrase "Maldives on budget" is too underspecified for reliable activation because it does not define whether the user wants flights, lodging, itinerary planning, or only general advice. In this skill's travel-booking context, insufficient specificity can map a casual budgeting question into a transactional flow that makes hidden assumptions about accommodations or transport.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records the raw user query in an internal execution log, which can capture sensitive travel data such as names, passport details, contact info, payment-related text, itinerary details, or visa information. In a travel-booking skill, users are especially likely to submit personal and regulated data, so retaining raw input without minimization, redaction, access controls, or retention limits creates a real privacy and data-exposure risk.

Ssd 3

Medium

Confidence: 93% confidence
Finding: Appending execution logs to a local file creates persistent accumulation of interaction data, increasing the blast radius of any host compromise, misconfiguration, or accidental disclosure. Because this skill supports booking, insurance, visa, and reservation workflows, the logged records may include high-value personal travel data, making unsafeguarded persistence more dangerous in this context than in a low-sensitivity skill.

Static analysis

No suspicious patterns detected.