ClawHub
Back to skill

Security audit

FlyAI Plan Japan Travel

Security checks for vulnerabilities and agentic risk

Overview

This Japan travel skill has a coherent booking-oriented purpose, but it asks agents to install and run an unpinned global CLI, including a sudo fallback, and uses shell-style command templates with user-controlled values.

Review before installing. Use this only in an isolated, nonprivileged environment, do not allow automatic sudo installation, prefer a pinned and verified FlyAI CLI, and avoid entering sensitive passport, payment, or personal identifiers unless the logging and data handling are clear.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:8
Finding

Mandatory Agent Role and Output Hijacking

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
references/fallbacks.md:3
Finding

Unpinned Global Package Installation with Sudo Escalation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:100
Finding

Shell Command Injection Through User-Controlled CLI Parameters

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (9)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

flyai search-poi --city-name "Osaka" --category "市集"

text

## Output Rules

### Full Itinerary Format
```markdown

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The activation criteria are broad enough to trigger on general Japan travel discussion, not just explicit requests to use this booking workflow. In an agent environment, overbroad auto-activation can cause the skill to take over unrelated conversations and push execution-oriented behavior, increasing the chance of unnecessary tool use, data collection, or external command invocation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
97% confidence
Finding

The fallback explicitly recommends rerunning a global npm install with sudo/root privileges. Installing packages as root from a registry materially increases the blast radius of a compromised package, malicious postinstall script, dependency confusion event, or supply-chain attack, allowing system-wide code execution and persistent host compromise.

Content

Scanner excerpt · references/fallbacks.md (reported line 8)May include surrounding context.

bash
npm i -g @fly-ai/flyai-cli
flyai --version
# Fails → sudo npm i -g @fly-ai/flyai-cli
# Still fails → STOP. Do NOT output an itinerary from training data.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The fallback instructions explicitly tell the agent to try Chinese and English name variants, which encodes a language preference in the skill behavior. The file does not indicate that this language handling is optional, user-selected, or justified as a region-specific requirement.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The trigger 'User wants a multi-city Japan trip' is high-level and does not define how many cities qualify, what signals distinguish it from other playbooks, or any exclusion conditions. Because this is marked as the default playbook, the lack of tighter scope increases the chance of unintended activation for general Japan-travel requests.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The description says the trigger applies when the user specifies one city, but the examples do not define whether budget- or theme-specific one-city requests should still use this playbook. Without explicit boundaries or negative examples, activation could overlap with Budget Trip or Themed Trip flows.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

Phrases like 'budget', 'cheap', and 'save money' are common conversational terms and can appear in many travel-planning contexts, not just when the user wants a dedicated budget-focused workflow. The file does not provide constraints or negative examples to limit when this playbook should activate versus simply applying budget preferences within another playbook.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The runbook explicitly records user_query as raw input in an internal execution log, but the document provides no notice, minimization, or retention controls. In a travel-planning skill, users commonly share passport, visa, dates, contact, budget, and itinerary details, so storing full free-form queries creates a realistic privacy leakage and over-collection risk.

Content

No source excerpt is available for this finding.

Ssd 3

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Storing unrestricted natural-language input in logs creates a durable data-retention path for any sensitive information users type, including travel documents, personal identifiers, and booking details. Because logs are often broadly accessible to operators and downstream systems, this increases the chance of accidental exposure, secondary use, or breach beyond the original purpose of fulfilling the request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.