Security audit

student-deal

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is mostly purpose-aligned, but it tells agents to globally install and run an unpinned third-party CLI automatically and to execute user-derived shell commands without clear safeguards.

Review before installing. Use this only if you are comfortable with FlyAI/Fliggy receiving travel search details and with installing their CLI. Prefer manual, pinned, least-privilege installation, and do not let an agent pass untrusted free-form text into these shell command templates without validation.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Response-Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:74
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation
`. 3. Verify package integrity using a lockfile and approved integrity hashes. 4. Use a configured trusted registry and verify package provenance or signatures where available. 5. Install the dependency locally in an isolated directory, container, sandbox, or dedicated virtual environment instead of globally. 6. Run installation and execution with the least-privileged account available. 7. Disable npm lifecycle scripts where compatible, such as with `--ignore-scripts`, and separately review any scripts that must run. 8. Audit and pin transitive dependencies. 9. Verify the resolved executable path before invocation so that an unrelated or spoofed binary is not trusted. 10. Document a supported installation process rather than forcing the agent to mutate the host environment. ]]>

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:93
Finding: Shell Command Injection Risk from Unvalidated User-Controlled Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 160)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Xiamen" --dep-date-start 2026-07-01 --dep-date-end 2026-07-15 --seat-class-name economy --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with cheapest student-eligible fare 2. **Student tips** — remind about student verification and flexible rebooking

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest markets a broad set of capabilities including hotels, trains, attractions, visas, insurance, and car rentals, but the body of the skill only defines flight-search CLI behavior. This mismatch can cause an agent or user to rely on unsupported workflows, increasing the chance of incorrect tool use, misleading outputs, or unsafe fallback behavior outside the documented scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill mandates automatic global installation of @fly-ai/flyai-cli via npm i -g without user consent, warning, or trust verification. Installing and executing software changes the host environment and can expose the system to supply-chain, privilege, and persistence risks, especially in an agentic CLI context.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill says undocumented CLI flags must never be invented, yet later maps 'round-trip student' to --back-date, which is not listed in the Parameters table. This inconsistency can drive agents to execute unsupported commands, fail unpredictably, or guess tool behavior in ways that undermine safe, deterministic operation.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 86% confidence
Finding: The fallback workflow broadens queries with keyword-search and booking lookups using user travel data, but does not warn that origin, destination, and travel intent may be transmitted to external services. While common for travel tools, the lack of disclosure reduces informed consent and can leak potentially sensitive itinerary information.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.