Security audit

hostel-finder

Security checks for vulnerabilities and agentic risk

Overview

This travel skill appears purpose-aligned, but it can automatically install a global CLI package and send travel searches to an external service without a clear user approval step.

Review before installing. Only use this skill if you are comfortable with a third-party travel CLI receiving your itinerary details, and require explicit approval before any npm install or command execution. Prefer installing the CLI in an isolated environment with a pinned version, and narrow the activation wording if possible.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (7)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill explicitly says unlisted flags must never be invented, yet a later playbook uses `--journey-type 1` even though that flag is absent from the documented parameter table. This kind of self-contradiction can cause agents to execute undocumented commands, weakening guardrails around tool use and making behavior less predictable and auditable.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation trigger includes broad phrases such as generic travel-booking terms, which can cause the skill to activate outside its intended niche. In this skill, over-activation is more dangerous because activation leads to mandatory CLI execution and possible package installation, so a normal travel query could unexpectedly trigger system-affecting actions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The skill instructs the agent to automatically install a global npm package if the CLI is missing, without warning or consent. Automatic system modification is dangerous because it changes the host environment, can introduce supply-chain risk from external packages, and violates the principle of least surprise for users who only asked for travel information.

Missing User Warnings

Medium

Confidence: 99% confidence
Finding: The fallback path operationalizes the same risky behavior by running `npm i -g @fly-ai/flyai-cli` when `flyai` is absent. Because this is embedded as a mandatory recovery step, an agent following the skill may perform unapproved global installs during routine use, creating avoidable supply-chain and host-integrity risk.

Vague Triggers

Medium

Confidence: 86% confidence
Finding: The trigger phrases in this range include very generic terms like "cheap," "budget," and "fast," which can easily appear in ordinary travel conversation and unintentionally activate a playbook. In an agent setting, overly broad triggers can cause the system to execute external flight-search actions when the user did not explicitly ask for that specific operation, creating unintended network activity and possible privacy leakage of travel parameters.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and can lead to inconsistent or overly aggressive activation of broader searches. Because the fallback includes a keyword-based external query, ambiguous activation can expand the scope of user data sent out and trigger searches the user did not clearly authorize.

Missing User Warnings

Low

Confidence: 80% confidence
Finding: The playbook performs external search commands, including a keyword-search query, without indicating any user notice or confirmation that data will be sent to a networked service. In a travel-booking context this may expose itinerary details such as origin, destination, and dates to third-party systems without sufficient transparency.

Static analysis

No suspicious patterns detected.