Security audit

island-flight

Security checks for vulnerabilities and agentic risk

Overview

This island flight skill has a coherent travel purpose, but it asks for automatic global software installation and keeps hidden local logs of raw travel queries.

Review before installing. Use only if you are comfortable with a global npm CLI, possible sudo install guidance, external transmission of trip details to flyai/Fliggy-backed services, and local hidden execution logs. Prefer requiring explicit confirmation before installs or command execution, pinning the CLI version, and disabling or redacting .flyai-execution-log.json.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The runbook explicitly records the raw user query and detailed execution metadata, then later instructs persisting that log to disk. In a travel-booking context, raw queries can contain personal, financial, itinerary, passport, visa, or contact information, so collecting and retaining them locally without necessity or minimization creates an unnecessary privacy and data exposure risk.

Context-Inappropriate Capability

Medium

Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a hidden local file, creating durable storage of potentially sensitive booking-related activity. Hidden local logging increases the chance of unnoticed retention, accidental disclosure, cross-session data leakage, or forensic recovery on shared systems.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to run a global package installation (`npm i -g @fly-ai/flyai-cli`) automatically if the CLI is missing, without requiring user consent or warning that it will modify the host environment. In an agent setting, this creates supply-chain and system-integrity risk because unreviewed code is fetched and installed from an external registry, potentially with elevated trust and persistent side effects.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The broad-search fallback sends user itinerary details into `flyai keyword-search --query "{origin} to {destination} island flights beach tropical"` without any notice that travel intent and route data are being transmitted to an external service. Even though origin/destination may seem low sensitivity, travel plans can reveal personal patterns, and the skill gives no consent step, minimization guidance, or privacy disclosure.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The file instructs users to globally install a CLI and escalate to `sudo npm i -g` if the first attempt fails, without any warning about elevated privileges, package trust, or system-wide modification risk. Running npm with sudo can execute package lifecycle scripts as root, increasing the blast radius of a compromised package, typo-squatted dependency, or supply-chain attack.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The schema stores raw user input without any user-facing disclosure about retention or handling. In this skill's travel domain, users may submit sensitive personal travel details, so silent persistence violates reasonable expectations and increases privacy/compliance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The runbook describes local filesystem writes for execution data but gives no warning that user-related activity may be stored on disk. Undisclosed local storage is especially risky for travel workflows because booking searches and itineraries commonly reveal personal behavior, locations, and other sensitive context.

Ssd 3

Medium

Confidence: 98% confidence
Finding: Taken together, the log schema and persistence instructions create a full pathway for collecting raw user input and writing it to local storage. In a travel-booking skill, this broad telemetry is not justified by core functionality and can expose sensitive travel plans, identifiers, and operational metadata if the host is compromised or shared.

Static analysis

No suspicious patterns detected.