Security audit

graduation

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is coherent in purpose, but it needs review because it auto-installs a global npm CLI and can silently retain raw travel queries in a local log.

Review before installing. This skill may install a third-party npm package globally, route results through flyai/Fliggy booking links, and keep raw travel queries in a local log. Install only if you are comfortable with that provider dependency, and prefer requiring approval for installs and disabling or removing persistent raw-query logging.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:36
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:34
Finding: Shell Command Injection Through Raw Query Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The log schema includes the user's raw input, and the persistence example interpolates the complete generated JSON into a single-quoted shell string. The runbook does not require shell escaping, safe argument handling, or structured file APIs. A single quote in attacker-controlled input can terminate the shell string. Shell metacharacters placed after that quote can then be parsed as commands. JSON escaping is insufficient because JSON encoding does not make data safe for interpolation into shell source code. For example, a query shaped like `' ; attacker_command ; #` could break out of the quoted argument if copied into the generated command without additional shell-specific escaping. ### Attack Path 1. An attacker supplies a travel query containing a single quote followed by shell syntax. 2. The raw query is inserted into the `user_query` field of `generation_log_json`. 3. The ag ...[truncated 851 chars]
Remediation: View remediation

other

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistence of Raw User Queries and Command History
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain complete raw queries, timestamps, commands, fallback actions, and output metadata in a hidden local file. It explicitly states that the internal log is not shown to users. No consent mechanism, data-minimization policy, redaction procedure, access restriction, retention period, rotation policy, or deletion process is defined. Travel queries can reveal locations, dates, budgets, group activities, and future absence from a residence. Raw queries may also accidentally contain contact details or other sensitive information. Append-only persistence retains this material beyond the immediate purpose of answering the request. ### Attack Path 1. A user submits a travel request containing itinerary or personal information. 2. The a ...[truncated 833 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-flight --origin "Wuhan" --destination "Lijiang" --dep-date-start 2026-06-15 --dep-date-end 2026-07-15 --seat-class-name economy --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with cheapest option (budget priority) 2. **Grad tip** — note popular grad destinations and timing

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The manifest description claims a broad travel-booking capability across multiple product types. However, the skill instructions and all concrete command examples in this file are limited to flyai search-flight and one flight-related keyword-search, with no documented workflow for hotels, trains, attractions, visas, insurance, or car rental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill instructs the agent to automatically run a global package installation (npm i -g @fly-ai/flyai-cli) whenever the CLI is missing, without requiring user consent. This causes an unreviewed system modification and introduces supply-chain risk, since the agent may fetch and execute remote package install scripts with the user's privileges.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The playbook hard-codes trigger phrases in English and Chinese for activation, but does not state that language selection is optional or user-driven. This is a natural-language policy concern because the skill prescribes specific languages/locales rather than explicitly offering a choice or documenting a justified locale restriction.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The runbook says the execution log is maintained internally and not shown to users, while capturing raw input and execution details. Silent collection and optional persistence of travel-related queries is risky because users are not informed that potentially sensitive trip, identity, or booking information may be retained behind the scenes.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly stores the raw user query and detailed execution telemetry, and may append that data to a local file. In a travel-booking skill, user queries can contain personal, financial, itinerary, or visa-related information, so retaining them without clear necessity, minimization, or consent creates an unnecessary data exposure surface.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 76% confidence
Finding: This documentation creates an intent mismatch inside the skill guidance: the prerequisite example invokes search-flight with --sort-type 2, while the parameters section states the default is 3 and describes that as the budget-priority default. That contradiction can cause the agent to execute behavior inconsistent with the stated booking intent.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.