Security audit

Travel Insurance

Security checks across malware telemetry and agentic risk

Overview

This travel-insurance skill matches its purpose, but it needs review because it can install a global CLI and save raw travel prompts locally without clear consent.

Install only if you are comfortable reviewing and approving the flyai CLI install yourself, sending travel-insurance search details to Flyai/Fliggy, and managing or disabling the local execution log. Avoid entering passport, payment, medical, or other sensitive details unless you know how the CLI and log file handle them.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Vague Triggers

Medium

Confidence: 79% confidence
Finding: The activation triggers are broad enough that generic terms like 'insurance' or 'coverage' may cause this skill to activate for unrelated requests, creating unintended tool use and possible data disclosure to the external CLI/service. In an agent setting, overbroad routing increases the chance of executing networked commands on queries outside the intended insurance-search scope.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger phrase "travel insurance" is very broad and likely to match many ordinary user requests, which can cause the skill to activate when the user did not intend to invoke this specific playbook. In a command-executing skill, overly broad activation increases the chance of unintended external queries and can route user requests through the wrong workflow.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The trigger "medical insurance abroad" is underspecified and does not define sufficient activation constraints, so it may match loosely related health, visa, or safety questions. Because the file states answers should not be given without executing CLI commands, ambiguous triggering can lead directly to unnecessary tool use and unintended data flow to the external search backend.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The trigger "comprehensive travel insurance" is generic and can activate on normal conversational mentions, causing unintended execution of the premium-insurance search flow. This is risky in an agent skill because generic triggers combined with automatic command execution reduce user control and may produce irrelevant or privacy-impacting outbound queries.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The playbook hardcodes a Chinese query string ("旅行保险 {dest}") without checking the user's language preference or obtaining consent. This can degrade accuracy, mis-handle non-Chinese destinations or user inputs, and send transformed queries to the external service in a language the user did not request, which is an avoidable integrity and usability risk.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The command forces the query into Chinese ("境外医疗保险 {dest}") regardless of user intent, which can cause mismatches between the user's request and the backend search semantics. In a travel-related skill that may serve international users, forced language conversion increases the risk of inaccurate results and unintended parameter interpretation.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The premium-insurance playbook also hardcodes a Chinese search phrase ("全面旅行保险 {dest}") without user opt-in, creating the same risk of silent language coercion. This is more concerning in this skill because the playbook is intended to drive external product search, so language mismatch can materially change result quality and user understanding.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records the raw user query and appends the execution log to a local file, creating a persistent store of potentially sensitive travel data without any stated minimization, redaction, consent, retention limit, or access control. In this skill context, user queries may contain names, passport/visa details, destinations, travel dates, booking intents, and other personal data, so retaining raw input increases privacy, compliance, and secondary exposure risk if logs are later accessed or leaked.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.