Security audit

Explore Xinjiang

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent travel-planning wrapper, but it mandates unpinned global CLI installation and hidden persistent logging of raw travel queries.

Review this before installing. Use it only if you are comfortable with FlyAI/Fliggy being the required data source, with booking links in outputs, and with installing an unpinned global npm CLI. Do not allow persistent logging of raw travel queries unless you understand where the log is stored and how to delete it; prefer a pinned, local, reviewed CLI install and disable raw-query logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistent Logging of Raw User Queries and Command History
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook explicitly directs the agent to maintain a hidden log that includes the user's complete raw input, collected parameters, CLI commands, fallback commands, timestamps, and request identifiers. It then persists the records by appending them to `.flyai-execution-log.json`. Travel requests can contain personally identifying or sensitive information, including travel dates, departure locat ...[truncated 1866 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:36
Finding: Shell Command Injection Through Unsafe Execution-Log Serialization
Content: View full analysis
> .flyai-execution-log.json ``` The interpolated object is documented as including raw user-controlled content: ```json { "request_id": "{uuid}", "skill": "{skill-name}", "timestamp": "{ISO-8601}", "user_query": "{raw input}", "steps": [ { "step": 2, "action": "cli_call", "command": "...", "status": "success | empty | error", "result_count": 0, "latency_ms": 0 } ] } ``` ### Technical Analysis The logging instruction interpolates serialized JSON directly inside a single-quoted shell argument. The JSON contains the user's raw input and may also contain commands derived from user-supplied parameters. JSON escaping does not make data safe for shell evaluation, and a literal apostrophe in a field can terminate the shell's single-quoted string. If an implementation follows the documented command by textual substitution and invokes it through a shell, attacker-controlled input can break out of the `echo` argument and introduce shell metacharacters. The issue is caused by mixing data serialization with shell source construction instead of using a structured file-writing API. Exploitation depends on the agent or runtime performing literal interpolation into the documented shell command. The runbook explicitly recommends that pattern, so implementations following it are exposed. ### Attack Path 1. The attacker submits a query containing a single quote followed by shell syntax. 2. The skill records that query verbatim as `{raw input}` in `generation_log_json`. 3. The implementation substitutes the generated JSON into: `echo '{generation_log_json}' >> .flyai-execution-log.json` 4. The attacker's quote closes the intended single-quoted shell argument. 5. Subsequent shell metacharacters are interpreted by the shell rather than writt ...[truncated 1134 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:31
Finding: Automatic Installation and Execution of Unpinned Third-Party Packages
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Urumqi" --dep-date 2026-09-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 86% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package or tool version. This can cause users to execute whatever version is current at install time, increasing supply-chain risk if the package or its dependencies are compromised or changed unexpectedly.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "Xinjiang trip" is broad and can match ordinary user travel queries without a clear requirement that the user explicitly invoke this playbook. In a system that auto-selects skills or workflows from trigger text, this can cause unintended activation and execution of booking/planning actions, producing incorrect tool use or over-collection of trip parameters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly logs user_query as raw input in an internal execution record, which can capture sensitive personal, financial, or travel-related data without minimization or notice. Because the same document also defines optional persistence to a local log file, the data can be retained longer than necessary and exposed through later access, debugging, or misconfigured storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs the agent to record detailed execution logs including raw natural-language input, commands, fallback actions, and output metadata, then append them to .flyai-execution-log.json when writes are available. In a travel skill context, queries may contain names, itineraries, visa questions, booking details, or other sensitive data, so persistent logging materially increases privacy and secondary exposure risk.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The phrase "Silk Road trip" is ambiguous because it could refer to general informational travel discussion rather than a request to activate this specific playbook. That ambiguity increases the chance of the agent selecting this workflow when the user intended a broader or different itinerary, leading to unintended downstream actions.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The trigger "Kanas autumn" lacks explicit activation rules and may be matched from casual conversation about seasonal travel rather than a directive to run this playbook. In an agentic environment, loose triggers can cause unintended workflow selection and reduce user control over travel-planning or booking steps.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.