Security audit

island-flight

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent flight-search helper, but it asks agents to install an unpinned global CLI, may escalate to sudo, and persists raw user queries locally without clear user control.

Install only if you are comfortable with this skill running a third-party travel CLI and producing booking links. Do not let it auto-install packages globally or use sudo; install any CLI manually in a scoped environment after checking the package source and version. Avoid using it with sensitive travel details unless logging is disabled or redacted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:17
Finding: Skill instructions override normal agent behavior and force external commercial output
Content: View full analysis
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/fallbacks.md:5
Finding: Fallback procedure directs the agent to perform an unauthorized privileged global installation
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:69
Finding: Unpinned global npm installation exposes the host to mutable supply-chain code
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:32
Finding: Raw user queries are persisted through an unsafe shell logging pattern
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to persist the raw user query, collected parameters, commands, and recovery commands in a hidden plaintext file. Travel queries may include names, dates, locations, budgets, or other personal itinerary information. No retention period, access-control requirement, consent mechanism, redaction policy, or encryption requirement is specified. The shell example is also unsafe if `{generation_log_json}` is substituted directly into the command. A single quote in any user-controlled JSON value terminates the shell's single-quoted string. The remaining text can then be interpreted as shell syntax. JSON encoding alone does not escape values for safe shell interpolation. For e ...[truncated 1441 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-07-15 --journey-type 1 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best island-compatible option 2. **Island tip** — note ferry/transfer requirements for specific islands

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The fallback instructs a global npm install and then escalates to sudo npm i -g, which can modify the host system and execute package lifecycle scripts with elevated privileges. In an agent-skill context, documenting this as a recovery step without strong warnings or safer alternatives increases the chance of unsafe system-wide changes on the machine running the skill.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 98% confidence
Finding: The file explicitly recommends retrying with sudo npm i -g @fly-ai/flyai-cli, which encourages running package installation as root. Because npm packages may run install scripts, this creates a direct path to privileged code execution and host compromise if the package, dependency chain, or registry path is tampered with.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrases for the island-flight skill are broad enough to activate on common travel queries like 'fly to island', which may cause the wrong skill to handle requests outside its intended niche. Because the playbook explicitly says to answer via CLI execution only, accidental activation could route generic travel requests into this provider-specific workflow and produce unintended actions or irrelevant command execution.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The budget playbook uses broad trigger language such as 'cheap island flight' and related variants without clear boundaries, which increases the chance of over-matching ordinary bargain-travel requests. In a multi-skill environment, this can misroute users into the wrong workflow, causing unintended searches, degraded trust, and possibly execution of commands with loosely inferred parameters.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The file states the execution log is maintained internally and not shown to users while the schema includes user_query: {raw input}. This creates undisclosed collection of potentially sensitive user-provided travel information, which is risky because users are not informed that their full prompts may be retained for internal processing.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records the raw user query and persists execution logs to a local file, even though the skill's stated purpose is travel search/booking rather than telemetry or security auditing. Travel queries commonly contain personal and sensitive data such as destinations, dates, names, visa needs, and booking details, so retaining raw input creates unnecessary data exposure and secondary-use risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs persistent retention of raw user input by appending the generated log JSON to .flyai-execution-log.json. Persistent storage increases the blast radius of any compromise or accidental exposure, especially in a travel skill where prompts may include personal itinerary, insurance, visa, and reservation details.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.