Security audit

group-charter

Security checks for vulnerabilities and agentic risk

Overview

The skill is a flight-search wrapper, but it requires automatic global installation of an unpinned CLI and runs user-derived shell commands with weak scoping.

Review this carefully before installing. The useful behavior is live flight search through flyai, but installation may globally add an unpinned npm CLI, send trip details to an external service, and force booking-link branded results. Only use it in an environment where you are comfortable with that dependency and data flow, and prefer explicit approval, pinned versions, and sandboxed execution.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Mandatory Agent Behavior and Commercial Output Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. ``` The output manipulation is reinforced by the following instructions: ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Charter tip — CLI shows scheduled flights; actual charter requires contacting operator** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` ### Technical Analysis The Skill redefines the Agent as a dedicated CLI executor and imposes absolute instructions that suppress independent responses. It requires all displayed results to originate from one external provider and mandates insertion of booking links and provider branding. The Skill also contains a self-validation mechanism requiring re-execution when the generated response does not contain the prescribed links. This makes the behavior persistent within the active session and prioritizes commercial redirection over neutral fulfillment of the user's request. The mismatch be ...[truncated 1434 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:66
Finding: Automatic Global Installation and Execution of an Unpinned npm Package
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` The fallback file repeats the installation requirement: ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The Skill mandates global installation of `@fly-ai/flyai-cli` when the executable is unavailable. The dependency is not pinned to a reviewed version, and no integrity digest, lockfile, provenance verification, signature check, or package-source validation is provided. An npm installation can execute package lifecycle scripts such as `preinstall`, `install`, and `postinstall`. A global installation also modifies the invoking user's global npm environment. Consequently, the effective executable payload is controlled by whichever package version the registry resolves at execution time rather than by the statically audited Skill. The audit evidence does not establish that the named package is currently malicious. The vulnerability is the mandatory, unpinned, globally scoped installation and immediate execution of mutable third-party code. ### Attack Path 1. The Skill is activated on a system where `flyai` is not installed. 2. The mandatory environment check fails. 3. The Agent runs `npm i -g @fly-ai/flyai-cli`. 4. npm resolves the current package release from the configured registry. 5. Any lifecycle scripts execute with the permissions of the Agent's operating-system account. 6. The package installs a global executable or modifies the global npm environment. 7. The Agent immediately executes `flyai --ver ...[truncated 927 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:44
Finding: Shell Command Injection Through Unsafely Interpolated User Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 141)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Charter tip — CLI shows scheduled flights; actual charter requires contacting operator**

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The manifest description says the skill supports flight booking, hotel reservation, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. However, the documented executable behavior in this file is limited to flyai search-flight commands and flight-oriented output rules, with no corresponding workflows for hotels, trains, attractions, visas, insurance, or car rental.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The workflow requires sending user travel details to an external CLI/service but provides no privacy or network-transmission warning. Origin, destination, dates, and related booking intent may be sensitive trip data, and transmitting them without disclosure or consent creates privacy and data-governance risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to globally install @fly-ai/flyai-cli via npm i -g if the tool is absent, causing an unprompted system modification. Auto-installing external software expands the attack surface, may execute unreviewed post-install scripts, and violates least-privilege expectations for user environments.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that only parameters listed in the table may be used, then later introduces --journey-type outside that table. This contradiction weakens command safety constraints and can normalize undocumented flag usage, making it easier for an agent to accept unverified parameters or execute incorrect commands against an external CLI.
Content: No source excerpt is available for this finding.

Ssd 2

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The skill semantically introduces an undocumented parameter in scenario mapping despite an earlier rule forbidding invented flags. This inconsistency undermines trust in the command specification and increases the chance that agents will construct commands from prose rather than a validated interface definition, which can lead to unsafe or unintended external tool usage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes generic everyday terms like "cheap" and "budget", which commonly appear in ordinary conversation and are not specific to flight-search intent. Without tighter scope or exclusion examples, this playbook could activate when the user is discussing cost generally rather than requesting this specific skill behavior.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The phrases "fast" and "quick" are broad conversational terms that overlap heavily with normal speech and do not clearly indicate a flight-search optimization request. The file does not provide constraints or negative examples to distinguish this trigger from unrelated uses.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The file includes fixed Chinese-language examples and explicitly requires prices to be formatted in CNY, but it does not state that the skill is limited to a China-specific audience or allow the user to choose locale/currency. This can violate language/locale policy by imposing a specific regional format without opt-in.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The fallback guidance states that city names must use Chinese or English, which is a natural-language locale restriction. The file does not offer users a language choice or explain a region-specific reason for limiting accepted languages.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The trigger "0 results from above playbooks" is an internal condition rather than a clearly defined user-facing activation rule, and it does not specify how or when the fallback is selected. This ambiguity can lead to inconsistent or unintended execution of the broad search behavior.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.