T01 · Skill Instruction Hijacking
Warning
- Location
SKILL.md:10- Finding
Coercive Agent Behavior and Output Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Plan Luxury Trips — Five-Star Hotels, First Class Flights, Premium Resorts & VIP Travel
Security checks for vulnerabilities and agentic risk
Overview
This travel-planning skill is purpose-aligned overall, but it asks agents to install an unpinned global CLI package and persist raw user travel queries in a local log without clear user control.
Review before installing. Use this only if you are comfortable with a third-party travel CLI, external booking links, and commercial branding in results. Do not allow automatic global npm installation; prefer a pinned version in an isolated environment. Disable or remove the execution log behavior, especially for queries containing names, dates, budgets, passport details, or other private travel information.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:32- Finding
Unpinned Global Installation of a Third-Party npm Package
- Content
View full analysis
- Remediation
View remediation
`. 3. Verify package integrity using a trusted digest, lockfile, signature, or registry provenance mechanism. 4. Review the package and its dependency graph before approval. 5. Avoid global installation. Use an isolated project environment, disposable container, or sandbox. 6. Disable lifecycle scripts where compatible, such as with `npm install --ignore-scripts`, and separately review any required setup behavior. 7. Run the CLI as an unprivileged account with restricted filesystem and network access. 8. Do not request or automatically use `sudo` if global installation fails. 9. Maintain an allowlisted version and require a new security review before upgrades. 10. Document removal procedures and clean up the isolated dependency after execution when it is no longer required. ]]>
T09 · Insecure Skill Coding Practices
Error
- Location
references/runbook.md:31- Finding
Shell Command Injection and Sensitive Data Exposure in Execution Logging
- Content
View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging design places the raw user query and complete command strings into generated JSON and then interpolates that JSON directly into a single-quoted shell command. Single quotes protect shell text only until a literal single quote appears in the interpolated value. A crafted user query containing a single quote can terminate the quoted `echo` argument. Shell metacharacters following that quote can then be interpreted as commands. JSON escaping does not provide shell escaping, and the runbook does not require any separate shell-safe encoding. The log also retains raw user queries and commands in a hidden plaintext file. Travel requests can contain names, locations, travel dates, preferences, and other personally sensitive information. No consen ...[truncated 1719 chars]- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
Full luxury orchestration
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The runbook explicitly logs the raw user query in an internal execution record, which can capture sensitive personal, financial, or travel data. Because the document also frames the log as maintained internally and not shown to users, this creates undisclosed data retention and privacy exposure if logs are accessed, mishandled, or retained longer than necessary.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Taken together, the schema stores natural-language raw input and the persistence section writes that data to a local file, creating a straightforward retention and leakage path. In a luxury travel skill, user queries may contain passports, names, destinations, dates, budgets, or other sensitive itinerary details, so the context increases the privacy risk rather than reducing it.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The runbook instructs the agent to append execution logs to a local file when filesystem writes are available, but provides no notice, consent, or safeguards around local persistence. Local log files are easy to overlook, may inherit weak permissions, and can expose prior user requests and operational metadata to other processes or users on the host.
- Content