ClawHub
Back to skill

Security audit

spa-hotel

Security checks across malware telemetry and agentic risk

Overview

This travel-booking skill is not visibly malicious, but it should be reviewed because it can automatically install an unpinned global CLI for broad travel requests.

Install only if you intentionally want an agent to use flyai for travel searches and you trust `@fly-ai/flyai-cli`. Prefer installing a pinned version yourself or running it in an isolated environment, and require explicit approval before any `npm i -g` command. There is no artifact-backed evidence of theft or destructive behavior, so this is Review rather than malicious.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Intent-Code Divergence

Medium
Confidence
94% confidence
Finding
The skill explicitly says agents must never invent CLI parameters, yet a later playbook uses `--journey-type 1`, which is not listed in the documented parameter table. This creates a specification mismatch that can cause agents to rely on undefined behavior, fail unpredictably, or start probing unsupported flags in ways that weaken safe tool usage guarantees.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The activation triggers include broad terms like `travel booking`, `trip search`, and `订酒店`, which can match many generic travel requests unrelated to spa hotels. That increases the chance the skill activates out of scope and drives the agent into executing travel-booking workflows or external commands when a narrower or different skill should have handled the request.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to automatically run `npm i -g @fly-ai/flyai-cli` if the tool is missing, without user confirmation or trust verification. Automatic installation of third-party software is risky because it changes the host environment, may execute package lifecycle scripts, and can introduce supply-chain compromise or unauthorized system modification.

Ssd 3

Medium
Confidence
90% confidence
Finding
The environment-check workflow tells the agent to inspect local tool availability and then install and run an external CLI, which can reveal environment state and encourage action based on that state in a conversational context. In an agent setting, this can expose local configuration details or lead to unintended execution paths driven by prompt content rather than explicit user authorization.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.