Security audit

infant-flights

Security checks for vulnerabilities and agentic risk

Overview

This infant-flight skill has a coherent travel purpose, but it asks agents to install and run an unpinned global CLI, force booking-link output, and keep hidden local logs of user travel requests.

Review before installing. Only use this skill if you trust the flyai CLI source and are comfortable sending travel searches to that service and receiving commercial booking links. Do not allow sudo installation, require explicit approval before any package install, and avoid entering passport numbers, payment data, or other sensitive identity details unless the logging behavior is removed or controlled.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Agent Behavior and Commercial Output Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:3
Finding: Unpinned Global Package Installation with Root-Level Fallback
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:88
Finding: Shell Command Injection Through Unvalidated Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:5
Finding: Unsafe Persistent Storage of Raw User Queries and Commands
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain the complete raw user query, collected parameters, executed commands, and recovery commands in `.flyai-execution-log.json`. Travel requests can reveal sensitive itinerary dates, family circumstances, budgets, and locations. No consent mechanism, redaction policy, retention period, deletion procedure, access-control requirement, or restrictive file mode is defined. The hidden filename may also make users less likely to notice the stored data, while not providing any security protection. The persistence command serializes generated JSON through a shell `echo` statement. If untrusted raw input is inserted into `generation_log_json` without robust encoding, quotes and shell syntax can corrupt the log or potentially cause shell command injection ...[truncated 1487 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 158)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-06-01 --dep-hour-start 6 --dep-hour-end 20 --journey-type 1 --sort-type 8

text
## Output Rules 1. **Conclusion first** — lead with shortest/direct flight 2. **Baby travel tips** — remind about bassinet request, infant fare rules, and carry-on milk policy

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to install @fly-ai/flyai-cli globally if missing, which modifies the host system without prior user approval or an explanation of the security and operational impact. In an agent setting, silent package installation expands the attack surface and can introduce unreviewed code into the environment.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly says to never invent CLI parameters and only use flags listed in the parameters table, but later maps 'round-trip infant' to --back-date {date}, which is not documented in the table. This inconsistency can cause agents to execute unsupported commands or improvise behavior, undermining guardrails that were meant to constrain command execution.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The mandatory environment check includes npm i -g @fly-ai/flyai-cli as an automatic remediation path, again directing global system modification without disclosure or confirmation. Because the instruction is framed as 'mandatory, never skip,' an agent may perform the installation reflexively, making this especially risky in automated environments.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The fallback instructs installation of a global package and escalation to sudo npm i -g if the first attempt fails, without warning about trust, package integrity, or the risks of running npm as root. In an agent skill context, this can normalize privileged system modification and could lead to arbitrary code execution from package install scripts or persistent host compromise if followed blindly.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 97% confidence
Finding: Explicitly recommending sudo to install an npm package directs users toward running third-party installation scripts with root privileges. Because npm packages may execute lifecycle scripts during installation, this creates a direct path to full system compromise, persistence, or destructive changes if the package or dependency chain is malicious or tampered with.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data. # Tell user: "Please run npm i -g @fly-ai/flyai-cli manually."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction to automatically search the next available date after determining the requested date has passed changes a material booking parameter without confirmation. In travel booking, silently substituting dates can mislead the user, produce unwanted reservations, or cause downstream financial and itinerary errors.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly logs the raw user query in an internal execution record, and the file states this log is not shown to users. In a travel-booking context, raw queries can contain names, infant ages, passport or visa details, travel dates, and other personal data, creating a privacy and data-retention risk without notice, minimization, or consent.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Taken together, the schema and persistence instructions direct the agent to retain raw user input and operational details in an internal execution log. In this skill's travel domain, users may provide highly sensitive itinerary and identity-related information, so retaining it increases the blast radius of any accidental exposure, insider access, or host compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file, which can persist user and system data on disk beyond the active session. If those logs include queries, commands, booking links, or error details, they may be exposed to other processes, backups, operators, or later compromise, especially if file permissions and retention are not controlled.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.