Security audit

Southeast Asia

Security checks for vulnerabilities and agentic risk

Overview

This travel skill has a coherent booking purpose, but it asks agents to install and run an unpinned global third-party CLI and to persist raw user travel queries in a hidden plaintext log.

Review before installing. This skill should only be used if you are comfortable installing and running a third-party travel CLI, sending travel-search details to that service, seeing booking-link-centered results, and potentially leaving raw request logs in the workspace. Prefer requiring explicit approval before any npm install or CLI call, and disable or redact the execution log.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Commercial CLI and Output Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:119
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:7
Finding: Unredacted User Queries Persisted in a Plaintext Execution Log
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the complete raw user query along with command history, collected parameters, fallback commands, and execution metadata. Travel queries can contain names, locations, intended travel dates, budgets, accommodation requirements, or other personal information. The log is appended to a hidden plaintext file without any stated: - User consent requirement. - Sensitive-data redaction. - Retention or deletion policy. - Encryption requirement. - Restrictive file permissions. - Protection against symbolic-link attacks. - Isolation between users or sessions. The suggested persistence mechanism also interpolates generated JSON into a shell command. Although the JSON is enclosed in single quotes, unescaped apostrophes originating from a raw user query can terminate the shell-quoted string. If an implementation per ...[truncated 2034 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 198)May include surrounding context.
flyai search-flight --origin "Guangzhou" --destination "Bangkok" --dep-date 2026-11-01 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill requires all travel answers to come from the external flyai CLI, which necessarily sends user travel queries and possibly itinerary details to a third-party service, yet the skill description provides no privacy or external-execution warning. This can expose sensitive travel plans, locations, dates, and booking preferences without clear disclosure or consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to install @fly-ai/flyai-cli globally if it is missing, but the skill metadata/description does not warn users that it may modify their system. Automatic package installation is security-relevant because it executes third-party code and changes the host environment without prior informed consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture sensitive travel details, personal identifiers, payment-related text, passport/visa data, or other confidential information. Because the log is not shown to users and no notice, minimization, masking, or retention controls are described, this creates a real privacy and data-handling risk if logs are accessed, retained too long, or reused improperly.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs the agent to append execution logs to .flyai-execution-log.json, meaning request data may be persisted to disk beyond the immediate session. In a travel/booking skill context, those logs may contain itinerary requests, identity details, or other sensitive booking-related information, and persisting them without disclosure or safeguards increases exposure to unauthorized access, leakage, and over-retention.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.