ClawHub
Back to skill

Security audit

Explore Sanya

Security checks for vulnerabilities and agentic risk

Overview

This Sanya travel skill is coherent, but it asks agents to install a global third-party CLI automatically and can quietly retain raw travel queries in a local log.

Install only if you are comfortable using flyai/Fliggy as the travel data provider and with booking links in results. Treat the CLI install as a manual, explicit setup step; avoid letting an agent run `npm i -g` automatically. Review or disable `.flyai-execution-log.json` logging before entering personal travel details.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The skill explicitly instructs the agent to run `npm i -g @fly-ai/flyai-cli` as a mandatory prerequisite and even to auto-install it when `flyai` is missing. This causes system modification and execution of third-party code without explicit user consent, which is unsafe in agent environments because it can introduce supply-chain risk and violate least-privilege expectations.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger phrase "Sanya trip" is very broad and can match ordinary user travel requests that merely mention the destination, causing the playbook to activate without clear user intent. In a skill that states answers should never be given without execution, overbroad activation can route benign queries into automated booking or itinerary flows the user did not explicitly request.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The runbook explicitly records `user_query` as raw input and persists the generated log by appending it to a local file, but provides no consent, minimization, retention, or redaction controls. In a travel-booking skill, user queries may contain names, passport/visa details, contact info, travel dates, or payment-adjacent data, so indiscriminate logging creates an avoidable privacy and data-exposure risk if logs are accessed, exfiltrated, or retained improperly.

Static analysis

No suspicious patterns detected.