Security audit

Solo Trip

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it asks the agent to install and trust a global third-party CLI, force booking-link output, and persist raw travel queries without adequate disclosure or controls.

Review this skill carefully before installing. It is designed around a single external travel provider, may install a global npm CLI, may send trip details to that service through CLI calls, and may keep raw request logs locally. Use it only if you are comfortable with those behaviors and can control installation, logging, and deletion of stored logs.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Forced Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:113
Finding: Automatic Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistence of Raw User Queries Through Unsafe Shell Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the agent to retain each user's raw query, command history, timestamp, fallback actions, and execution metadata in `.flyai-execution-log.json`. It expressly states that this internal logging is not shown to users. Travel queries may contain sensitive personal information, including locations, travel dates, accommodation preferences, budget constraints, and itinerary details. The runbook defines ...[truncated 2431 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
Solo orchestration

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to run a global npm installation if the CLI is missing, which causes system modification without clear user consent or a warning. In an agent setting, this creates supply-chain and host-impact risk because the agent may fetch and execute code from the network automatically before fulfilling a travel request.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The trigger phrase "solo backpacking" is broad and maps to an execution-oriented playbook without additional contextual constraints. This can cause the skill to activate on ordinary travel conversation and initiate tool-driven booking/planning behavior when the user may have only been asking for general advice, increasing the risk of unintended actions or irrelevant parameter mapping.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The trigger phrase "safe for solo female" overlaps with common conversational safety questions and may activate a command sequence tied to flights, hotels, and attractions. Because the playbook is explicitly designed to execute rather than just answer, a vague trigger increases the chance of over-triggering on sensitive travel-safety discussions and driving unintended recommendations or downstream transactions.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly logs user_query as raw input in an internal execution log, which can capture sensitive personal, financial, passport, itinerary, or contact data commonly present in travel-booking requests. Because the log is retained internally without any documented minimization, consent, masking, or retention controls, it creates a real privacy and data-exposure risk if logs are accessed, mishandled, or reused.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The schema combines storage of raw natural-language input with optional on-disk persistence, which creates a concrete data-retention and leakage risk. In this skill's travel context, user messages may contain names, destinations, booking preferences, dates, visa details, or other sensitive trip information, making this more dangerous than generic telemetry because the logs can become an unprotected repository of personal travel data.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook instructs appending execution logs to a local file, but provides no user warning, no access-control guidance, and no restrictions on what data may be written. Persisting logs to disk increases exposure duration and broadens the attack surface because sensitive travel queries and operational details may remain readable by other processes, users, backups, or support workflows.
Content: No source excerpt is available for this finding.