Security audit

Explore Sanya

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly coherent, but it needs review because it can auto-install an unpinned global CLI and persist raw user travel queries in a hidden local log.

Install only if you are comfortable with a third-party travel CLI being installed globally and used for live travel searches and booking links. Before using it, pin and verify the CLI package version if possible, avoid entering highly sensitive personal or payment details, and disable or remove the hidden raw-query execution log behavior.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Booking-Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:127
Finding: Unpinned Global Installation and Execution of Third-Party Packages
Content: View full analysis
Remediation: View remediation
`. 2. Maintain a lockfile and verify package integrity hashes before installation. 3. Install dependencies locally in an isolated project directory instead of globally. 4. Require explicit user approval before downloading or executing third-party code. 5. Use a sandbox or container with restricted filesystem and network access. 6. Disable npm lifecycle scripts where compatible, such as with `--ignore-scripts`. 7. Verify package provenance using registry signatures, trusted publishers, or an internal artifact mirror. 8. Replace mutable `npx` invocations with pinned, reviewed tooling. 9. Document the precise package version and checksum covered by the security review. ]]>

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Unsafe Persistence of Raw User Queries Through Shell-Interpolated Logging
Content: View full analysis
> .flyai-execution-log.json ``` ### Technical Analysis The runbook instructs the agent to store the raw user query in a persistent local file while stating that the log is not shown to users. It does not define user consent, data minimization, redaction, restrictive file permissions, a retention period, or deletion behavior. Travel requests may contain sensitive information such as travel dates, locations, preferences, or other personal details. The suggested shell command is also unsafe if implemented literally. `generation_log_json` contains attacker-controlled `user_query` content but is interpolated inside a single-quoted shell string. A single quote in the user input can terminate the shell string. Shell metacharacters following that quote ...[truncated 1941 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date 2026-03-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package or revision, which can cause execution of whatever content is currently served under that reference at install time. In a supply-chain attack or upstream compromise, users could fetch altered skill code or installer logic without noticing, and README-driven install commands are often copied verbatim.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture personal data, travel details, contact information, passport/visa context, or payment-adjacent booking data. Because the skill handles travel booking and itinerary workflows, retaining raw queries without disclosure or minimization creates a meaningful privacy and data leakage risk if logs are exposed, mishandled, or reused.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Taken together, the schema stores raw user input and then persists execution records to a local file, creating a straightforward data retention and leakage path. In a travel skill context, user prompts may include names, trip dates, destinations, visa questions, booking preferences, and other sensitive itinerary details, so the combined design increases the chance of privacy harm from accidental disclosure or unauthorized access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs the agent to append execution logs to a local file, creating persistent storage of operational and potentially sensitive user-derived data without any warning, consent, protection, or lifecycle controls. Local plaintext log files are commonly overexposed through shared environments, backups, debugging bundles, or weak file permissions, making this a practical confidentiality risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This is a markdown file, so SQP-2 applies to omitted warnings in the skill description. The README states that the skill wraps a CLI to provide real-time travel data with booking links, which implies network access and navigation to third-party services, but it gives no warning about data transmission, external requests, or leaving the agent context.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.