Security audit

Fx Rates

Security checks across malware telemetry and agentic risk

Overview

This skill is a real travel/currency CLI wrapper, but it asks agents to auto-install a global third-party tool and persist raw query logs, so it needs human review before use.

Install only if you are comfortable with a global npm CLI being installed and run for your travel/currency searches. Avoid entering passport numbers, payment details, booking references, or other sensitive itinerary data unless logging is disabled or you understand where .flyai-execution-log.json is stored and how it is retained.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The README presents the skill as a narrow currency-exchange helper, but also discloses that it wraps flyai-cli for real-time travel data and booking links, implying materially broader capabilities than the title and primary description suggest. This kind of scope mismatch can mislead users and agents about what external actions, data access, or third-party integrations may occur, increasing the risk of over-trust and unintended invocation in contexts where booking-related behavior is not expected.

Context-Inappropriate Capability

Medium

Confidence: 94% confidence
Finding: The runbook explicitly logs raw user queries and full CLI commands as part of normal operation, even though this travel/currency skill does not require persistent collection of detailed execution telemetry to fulfill its purpose. Raw queries may contain sensitive travel details, booking data, personal identifiers, or payment-related context, and command logging can capture tokens, paths, or internal operational data that increase exposure if logs are accessed or reused.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of potentially sensitive interaction and operational data without a clear business need tied to the skill's stated function. Persistent local logs expand the attack surface by leaving recoverable artifacts on disk that may be read by other processes, exposed in backups, or retained far longer than intended.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically run a global package installation (`npm i -g`) if the CLI is missing, which modifies the host environment without explicit user consent. That creates supply-chain and environment-integrity risk, especially in agent contexts where command execution may be automated and the package source is external.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The workflow mandates sending user queries to the external `flyai` CLI/service but does not require a user-facing disclosure or consent step. This can expose potentially sensitive travel or financial queries to a third party without transparency, creating privacy and data-handling risk.

Natural-Language Policy Violations

Medium

Confidence: 95% confidence
Finding: The playbooks hard-code Chinese-language search queries (e.g., 汇率, 换汇, 支付方式) regardless of the user's language or locale. This can cause the agent to retrieve region-biased or linguistically inaccessible results, leading to incorrect financial guidance, poor usability, and silent failure for users who did not request Chinese-language sources.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The document states that the agent maintains an internal execution log that is not shown to users, while also defining storage of raw input and execution details, but provides no user-facing disclosure or consent mechanism. For a consumer travel/currency assistant, silent retention of user-provided travel and booking context is more dangerous because users are likely to share personal itinerary, location, or financial details without expecting hidden persistence.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook directs the agent to append logs to a local file but gives no warning that using the skill may modify the filesystem. Undisclosed writes are risky because they create hidden side effects, can accumulate sensitive data over time, and may violate operator expectations in constrained or multi-tenant environments.

VirusTotal

59/59 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.