Security audit

infant-flights

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent travel-search purpose, but it asks agents to install a global CLI and retain hidden raw travel-query logs without clear user control.

Review before installing. Only use this skill if you are comfortable with FlyAI/Fliggy receiving travel-search details, and do not allow automatic global or sudo installation unless you intentionally trust that CLI. Check whether `.flyai-execution-log.json` is created and remove or disable it if you do not want local travel-query history retained.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The fallback for invalid dates is internally contradictory: it says not to search because the date has passed, but then instructs the agent to auto-search the next available date. In a travel-booking skill, silently changing a user’s requested date can produce unauthorized or misleading results, causing bookings, price quotes, or itinerary recommendations for dates the user did not approve.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install and execute CLI tooling, including a global npm package installation, without requiring explicit user consent or warning about system modification. In agent environments, this can lead to unauthorized package installation, supply-chain exposure, and unexpected changes to the host system simply from processing a travel request.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The mandatory fallback to `npm i -g @fly-ai/flyai-cli` is a real security issue because it directs an agent to modify the system and fetch executable code from an external registry without approval gates. If executed automatically, this creates a clear supply-chain and environment-integrity risk, especially on privileged hosts or shared developer machines.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records raw user input and full CLI command details, and later instructs persisting the log to a local file. In a travel-booking skill, raw queries and command strings can contain personal data, travel dates, names, booking parameters, or internal tokens, creating unnecessary retention and possible disclosure of sensitive information without clear notice or minimization.

Natural-Language Policy Violations

Medium

Confidence: 92% confidence
Finding: The document states that the agent maintains execution logs internally and that they are not shown to users, while also defining storage of detailed request metadata. This creates an undisclosed data-handling practice that is especially sensitive in a travel skill, where requests commonly include personal and itinerary information users may not expect to be retained or hidden from them.

Static analysis

No suspicious patterns detected.