Security audit

Explore Usa

Security checks for vulnerabilities and agentic risk

Overview

This travel-planning skill is coherent, but it tells agents to install and run an unpinned global CLI and keep hidden raw-query logs, which users should review before installing.

Install only if you are comfortable with a Fliggy/flyai-centered travel workflow. Before using it, pin and review the CLI version, avoid automatic global npm installation, require explicit approval before running commands, and disable or redesign the hidden execution log so raw queries are not persisted through shell interpolation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:128
Finding: Automatic Installation and Execution of Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:8
Finding: Shell Command Injection Through Raw Query Log Persistence
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The persistence recipe places the generated JSON inside a shell single-quoted string. The JSON includes `user_query` populated from raw user input. JSON escaping does not make data safe for shell interpolation because a single quote has no special escaping mechanism inside a POSIX shell single-quoted string. If the recipe is implemented literally, a user query containing a single quote can terminate the shell string. Shell metacharacters following that quote can then be interpreted as commands. The redirection does not mitigate this because parsing and command expansion occur before output is appended to the log. For example, a malicious raw input conceptually shaped as: ```t ...[truncated 1819 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (12)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 208)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "New York" --dep-date 2026-07-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 92% confidence
Finding: The README instructs users to run npx skills add alibaba-flyai/flyai-skill/tree/main/skills/explore-usa, which references mutable remote content (main) and an unpinned package/tool invocation. If the upstream repository, branch, or resolved package content changes or is compromised, users may install a different skill than the one reviewed, creating a supply-chain risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill frames the agent as a 'CLI executor' and later instructs installing and using a global npm package, but does not require an explicit user-facing warning or consent before making system changes. This is dangerous because global package installation executes third-party code, modifies the host environment, and may initiate network access, all based on skill instructions rather than informed user approval.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation logic is broad enough to trigger on common travel-related mentions like 'USA', 'New York', or 'America', which increases the chance the skill activates in ordinary conversations where the user did not intend to invoke a booking-oriented CLI workflow. In this skill, accidental activation is more dangerous because the workflow explicitly pushes command execution and possible package installation, turning a routing mistake into unintended system and network actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The prerequisites and environment-check sections instruct automatic installation of '@fly-ai/flyai-cli' if missing, but omit a warning that this will change the system state and depend on external network resources. In context, this materially increases risk because the skill mandates installation as part of normal operation and even discourages safer fallback behavior, making silent third-party code execution more likely.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The markdown explicitly directs output toward a fixed locale at 'East Coast USA', and similar fixed regional constraints appear elsewhere in the file. This imposes a location-specific response policy without indicating that the user can choose a different locale or that the restriction is justified as region-specific.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The file specifies 'Output emphasis: West Coast California' as a required regional focus rather than a user-selected preference. Under the policy, forcing a specific locale without opt-in is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The playbook fixes the trip style and locale around US national parks without clarifying that this is an optional preset or a documented scope limitation. This can be read as enforcing a locale-specific output policy without user opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 80% confidence
Finding: The phrase 'Full cross-country adventure' prescribes a USA-wide geographic focus as the expected output. The file does not indicate that users may opt into or override this locale restriction, nor does it justify the constraint.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly stores the raw user query in an internal execution log and states that the log is not shown to users, with no disclosure, minimization, or retention controls. In a travel-booking context, user queries may contain personal data, passport/visa details, locations, dates, or payment-adjacent information, so silent collection increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The persistence step appends execution log data to a local file, creating durable storage of potentially sensitive request contents and command history without any user-facing warning or consent. Persistent local logs increase exposure through unauthorized access, accidental inclusion in backups/artifacts, or later reuse by other processes.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: The manifest frames the skill as planning U.S. travel and related bookings through Fliggy, but this fallback instructs a generic keyword search for flights to any country. That broadens behavior from a U.S.-adventure travel skill into open-ended flight discovery outside the stated destination focus.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.