Security audit

Explore Thailand

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is openly for FlyAI-powered Thailand planning, but it forces vendor CLI use, global package installation, commercial booking links, and hidden local logging in ways users should review before installing.

Install only if you intentionally want FlyAI/Fliggy-backed travel search with booking links and are comfortable installing a global npm CLI. Avoid entering passport numbers, payment details, credentials, or other sensitive personal data unless the logging behavior is removed or controlled. Prefer a pinned, isolated CLI install and opt-in redacted logging before using this in a real booking workflow.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Forced Vendor-Controlled Output and Commercial Link Injection
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:35
Finding: Automatic Installation and Execution of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:33
Finding: Shell Command Injection and Plaintext Retention Through Unsafe Execution Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The command inserts generated JSON into a single-quoted shell string. The JSON includes the raw user query and other dynamically generated values. If any interpolated value contains a single quote, it can terminate the quoted string. Subsequent characters can then be interpreted by the shell as operators or commands. For example, a user-controlled value shaped like the following could alter the resulting shell command: ```text '; attacker_command; echo ' ``` If inserted without shell-safe escaping, the effective command becomes structurally equivalent to: ```bash echo '...'; attacker_command; echo '...' >> .flyai-execution-log.json ``` The logging design also stores complete user queri ...[truncated 1700 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Bangkok" --dep-date 2026-12-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 89% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package or repository version, which can cause users to fetch and execute whatever content is current at install time. If the upstream package, dependency chain, or referenced branch is compromised, users may install altered code or skill content without noticing.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The activation triggers are broad enough to fire on generic mentions of Thailand-related destinations rather than an explicit intent to use this booking skill. In an agent environment, this can cause unintended takeover of unrelated conversations and drive unnecessary command execution or package installation prompts, expanding the attack surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs user_query as raw input, which can capture personal, financial, passport, itinerary, or other sensitive travel-booking data without any minimization, masking, or retention notice. In this skill context, users may provide highly sensitive booking details, so storing raw prompts materially increases privacy leakage risk through local access, debugging, or later reuse.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Taken together, the runbook instructs collecting raw user input, recording command activity, and persisting the resulting execution log, creating an end-to-end data retention pathway that can expose sensitive travel and booking information. Because this skill supports flights, hotels, visas, insurance, and rentals, the logged content may include names, dates, locations, contact details, and other personal data, making the context more dangerous than a low-sensitivity informational skill.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The runbook recommends appending execution logs to a local file, which creates durable on-disk storage of operational and potentially sensitive request data. Without encryption, rotation, permissions hardening, or disclosure, these logs can be exposed to other local processes, backups, or operators, turning transient user data into a persistent leak surface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The README advertises real-time travel data and booking links but does not clearly disclose that the skill may access external network services and redirect users to third-party booking platforms. This can mislead users about data flows, privacy exposure, and trust boundaries when interacting with booking providers.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.