Security audit

Explore Yunnan

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is coherent as a vendor travel-booking integration, but it asks agents to install unpinned global code automatically and persist raw user travel queries without clear user control.

Review this skill before installing. Use it only if you are comfortable with a vendor-controlled travel CLI, booking links in answers, networked travel searches, and local logs of your queries. Prefer a pinned CLI version in an isolated environment, require approval before installing packages, and disable or redact persistent logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Vendor-Controlled Instruction and Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:119
Finding: Automatic Installation and Execution of Unpinned npm Dependencies
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:33
Finding: Undisclosed Persistence of Raw User Queries and CLI Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to record raw user input and complete CLI commands in `.flyai-execution-log.json`, while explicitly stating that this internal logging is not shown to users. Travel requests can contain sensitive itinerary information, including departure locations, destinations, dates, budgets, accommodation preferences, and inferred periods when a user may be away from ...[truncated 2462 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Kunming" --dep-date 2026-04-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Rp1

Medium

Category: MCP Rug Pull
Confidence: 88% confidence
Finding: The README instructs users to run npx skills add ... without pinning a specific package version or immutable source reference. This can cause consumers to fetch whatever package/version is current at execution time, increasing supply-chain risk if the package is updated maliciously, hijacked, or if behavior changes unexpectedly. In this context, the skill is explicitly designed for installation and execution by agents/users, so unpinned bootstrap commands are more dangerous than ordinary documentation text.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to install a global npm package as part of normal execution, without requiring user approval or warning that it will modify the system. This creates a supply-chain and host-modification risk: an agent following the skill could change the user's environment or execute untrusted install scripts from the npm ecosystem.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The prerequisites section normalizes a global npm install as a required setup step but provides no safety notice, approval gate, or alternative non-mutating path. In an agent setting, this can cause unauthorized system changes and exposure to malicious or compromised package lifecycle scripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The fallback logic tells the agent to attempt a global installation automatically when the command is missing, which is especially risky because it turns a read-only information request into an environment-changing action. If exploited or blindly followed, this behavior could install untrusted code and persist changes on the host without informed user consent.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "Yunnan trip" is broad enough to match ordinary conversational queries rather than a clearly scoped invocation condition. In a travel-booking skill that can drive flights, hotels, and itinerary actions, this can cause unintended playbook activation and steer the agent into executing booking-oriented flows when the user may only be seeking general information.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger phrase "Dali and Lijiang" is ambiguous because it can naturally appear in casual travel discussion, comparison requests, or informational questions without implying the user wants this specific playbook run. Given the skill's ability to support reservations and ticketing, overlap between normal discussion and activation raises the risk of inappropriate tool selection and unintended transactional guidance.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger phrase "tropical Yunnan" is vague and underspecified, making it likely to activate on broad descriptive discussion rather than a deliberate request for the Xishuangbanna playbook. In this skill context, vague triggers are more dangerous because the assistant is connected to travel-planning and booking-related capabilities, so misfires can influence recommendations or downstream actions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly records the raw user query and persists the generated log to a local file, creating a clear data-retention path for potentially sensitive user information. In a travel-booking skill, user queries may contain names, dates, locations, passport/visa details, contact information, or other personal travel data, so storing raw input without notice, minimization, redaction, or retention controls increases privacy and compliance risk.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.