Security audit

FlyAI Search Cheap Flights

Security checks across malware telemetry and agentic risk

Overview

This flight-search skill is mostly purpose-aligned, but it needs review because it can install a global CLI with elevated privileges and log raw travel requests.

Review before installing. Use this only if you are comfortable with a third-party flight CLI receiving your trip search details. Prefer installing the CLI yourself in a scoped environment, avoid allowing sudo/global installs from the skill, and do not enter passport, payment, or highly personal travel details unless the publisher documents how logs are protected and deleted.

SkillSpector

By NVIDIA

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (5)

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to run `npm i -g @fly-ai/flyai-cli` automatically if the CLI is missing, which modifies the host environment without prior user consent or a clear warning. In an agent setting, automatic global installation increases supply-chain and system integrity risk because it pulls and executes third-party package installation steps on the user's machine.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The workflow directs the agent to send origin, destination, and travel dates to an external flight search service, but it provides no user-facing privacy notice or consent step. Travel itinerary data can be sensitive, and silent transmission to a third party creates unnecessary privacy and compliance risk, especially in enterprise or regulated environments.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The fallback instructs automatic global package installation and escalation to `sudo` without any warning about system modification, trust of the package source, or the risks of elevated privileges. In an agent context, this is dangerous because it can normalize making persistent system changes or running privileged commands on the host just to satisfy a missing dependency.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The schema explicitly stores the raw user query in an internal log without any stated notice, minimization, retention limit, or redaction. In a travel context, user queries can contain personal, financial, location, passport, visa, or itinerary details, so verbatim retention increases privacy exposure and the blast radius of any log access or breach.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The runbook directly instructs logging `user_query` as `{raw input}` verbatim, which can capture sensitive personal travel data and secrets entered by users. Because this skill also references hotels, visa info, tickets, and itinerary planning, the context makes verbatim collection more dangerous: users may supply names, dates of birth, passport details, contact information, and other sensitive travel metadata.

VirusTotal

VirusTotal engine telemetry is currently stale for this artifact.

View on VirusTotal

Static analysis

No suspicious patterns detected.