Security audit

Travel Insurance

Security checks for vulnerabilities and agentic risk

Overview

This travel-insurance skill has a coherent purpose, but it requires a global third-party CLI install and can silently persist raw user queries in local logs.

Review this skill carefully before installing. It is not clearly malicious, but it depends on a globally installed third-party CLI, routes answers through a commercial travel service, requires booking links, and may keep local logs of raw travel or insurance queries. Use it only if you are comfortable with those behaviors, and prefer a pinned, local CLI install with logging disabled or redacted.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:53
Finding: Mandatory Unpinned Global Third-Party Package Installation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Undisclosed Persistence of Raw User Queries and Unsafe Shell-Based Logging
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain `{raw input}` in a predictable plaintext file while explicitly stating that the internal log is not shown to users. Travel-related queries may include personal names, locations, dates, itinerary details, insurance needs, or other sensitive information. The design does not define user consent, data minimization, redaction, access permissions, retention duration, rotation, deleti ...[truncated 2104 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (7)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 127)May include surrounding context.
flyai keyword-search --query "旅行保险日本"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The activation list includes generic terms like "insurance" and "coverage," plus the Chinese term "保险," which are broad phrases that can appear in many unrelated contexts. The file only excludes visa queries and does not provide enough scope boundaries or negative examples to prevent unintended invocation for non-travel-insurance requests.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The playbooks hard-code Chinese-language search queries for all insurance lookups without any user locale check, consent, or documented reason for language coercion. This can mislead users, reduce result relevance, and route requests into a different market/language context than intended, which is especially risky for travel insurance where policy terms, coverage limits, and eligibility vary by region and language.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook directs the agent to record the raw user query and detailed CLI command execution for every request, even though those data elements are not necessary to provide travel-insurance comparisons. In this skill context, user queries may contain sensitive travel details, personal circumstances, or booking information, so collecting and retaining them expands privacy exposure and creates unnecessary internal surveillance/data-leak risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The schema stores user_query as raw input while the runbook says the log is maintained internally and not shown to users, indicating no clear disclosure or consent mechanism. In a travel-related skill, users may provide names, dates, destinations, health/trip concerns, and booking context, so silent internal capture of raw prompts creates a meaningful privacy and transparency issue.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The combined design stores raw natural-language input and allows persistent append-only logging, creating a straightforward data retention and leakage path. Natural-language prompts often contain unpredictable sensitive content, and in this travel-insurance context that can include itinerary details, identities, financial concerns, or emergency situations, making overcollection especially risky.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly enables filesystem persistence of execution logs by appending them to a local JSON file, which is not justified by the skill's stated business purpose. Persistent local logging increases the chance that sensitive travel queries, command data, or future secrets are retained longer than intended and exposed through misconfiguration, backup systems, or other processes on the host.
Content: No source excerpt is available for this finding.