Security audit

golf-trip

Security checks for vulnerabilities and agentic risk

Overview

This skill is a mostly coherent flight-search helper, but it should be reviewed because it can trigger too broadly and tells agents to install an unpinned global CLI package automatically.

Install only if you are comfortable with an agent using flyai for live travel searches and sending travel details such as origin, destination, dates, and preferences to that provider. Do not allow the automatic global npm install unless you separately trust `@fly-ai/flyai-cli`; prefer explicit approval, version pinning, or an isolated install before use.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill says agents must never invent CLI parameters and may only use flags listed in the Parameters Table, but later references unlisted flags such as `--journey-type` and `--seat-class-name`. This creates an instruction conflict that can push an agent to either violate the declared contract or attempt unsupported command execution, increasing the chance of unsafe or unreliable tool use.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Including the broad trigger phrase `plan a trip` allows this skill to activate on many generic travel requests unrelated to golf. Over-broad activation can cause the wrong skill to take control, leading to unintended command execution and increased exposure to the skill's install-and-run workflow.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The manifest advertises broad capabilities far beyond golf-flight booking, including hotels, visas, insurance, and car rental, without corresponding trigger constraints in the skill. This broadens the apparent scope and can cause misrouting or overreach into actions the workflow does not safely and clearly govern.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to install `flyai-cli` automatically if missing, which modifies the host environment without user consent. Silent package installation is dangerous because it executes a remote package supply chain step and can persist changes on the user's system.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The workflow contains `npm i -g @fly-ai/flyai-cli` as a mandatory fallback, again directing a global install with no confirmation or sandboxing. In the context of an agent skill, this is more dangerous because activation may be automatic, turning a user travel query into an unsolicited system-changing action.

Static analysis

No suspicious patterns detected.