Security audit

Luxury Hotel

Security checks for vulnerabilities and agentic risk

Overview

The skill is a real hotel-search integration, but it asks agents to install an unpinned global CLI, build shell commands from user input, and persist raw request logs without clear user control.

Install only if you are comfortable with a third-party travel CLI being installed globally and used as the exclusive data source for these travel results. Use an isolated environment, approve the CLI version yourself, avoid entering sensitive personal or payment details, and disable or remove the local execution log unless you intentionally need it.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Mandatory Provider Promotion and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:51
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:76
Finding: Shell Command Injection Through User-Controlled Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:33
Finding: Unsafe Persistent Logging of Raw User Input Through a Shell Command
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to persist raw user queries and complete command strings in a hidden project file without requiring consent, redaction, retention limits, restrictive permissions, or secure deletion. Travel requests can contain personal itineraries, dates, destinations, names, budget information, or other sensitive context. The persistence command inserts generated ...[truncated 1987 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Shanghai" --hotel-stars 5 --sort rate_desc --check-in-date 2026-06-01 --check-out-date 2026-06-03

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The skill mandates installing a global npm package (npm i -g @fly-ai/flyai-cli) automatically if the CLI is missing, without requiring explicit user consent or warning about system modification. In an agent context, this can trigger unreviewed code installation from a package registry, expanding the attack surface and enabling supply-chain compromise or unintended changes to the host environment.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes the Chinese phrase "总统套房" alongside English, but the file does not explain that the skill is bilingual, region-specific, or user-selectable by language. This can violate language/locale policy because it embeds a locale-specific activation requirement without explicit opt-in or justification.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger list includes the Chinese phrase "带SPA" but does not state that users may choose their preferred language or that the skill is scoped to Chinese-speaking contexts. Embedding locale-specific trigger phrases without opt-in or justification is a natural-language policy concern.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly records the user's raw input in an internal execution log, which can capture personal data, credentials, payment details, passport/visa data, or other sensitive travel information. Because the skill operates in a travel-booking context that commonly handles high-sensitivity data, retaining raw queries without clear notice, minimization, or redaction materially increases privacy and data-leak risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Taken together, the schema captures raw natural-language user input and the persistence section writes the resulting execution log to disk, creating a concrete data retention and leakage path. In this luxury travel/booking skill, users may submit names, itinerary details, booking references, contact data, passport or visa information, and payment-adjacent details, so compromise or misuse of logs can have significant privacy and fraud consequences.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook directs the agent to append execution data to a local file, creating persistent storage of operational and potentially sensitive request information. Persistent logging to disk without notice, encryption, retention controls, or scoping can expose data to other local processes, later operators, backups, or accidental inclusion in support bundles and repositories.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The templates claim outputs are 'Powered by flyai' and instruct users to use 'flyai-cli', while the skill metadata says the service is powered by Fliggy. This inconsistency can mislead users about the actual backend, create trust and provenance confusion, and cause users to run the wrong tooling or disclose travel queries to an unintended platform.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 99% confidence
Finding: Line L150 says both 'Use detailUrl for booking links' and 'Never use detailUrl.' This is an internal documentation contradiction that can mislead an agent about whether the required booking URL should be included.
Content: No source excerpt is available for this finding.