Security audit

Travel Simcard

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is not clearly malicious, but it needs Review because it can auto-install a global CLI and persist raw user queries without adequate safeguards.

Install only if you are comfortable with a Fliggy/flyai-centered booking workflow. Do not allow unattended global npm installation; prefer a reviewed, pinned, isolated CLI install. Avoid entering sensitive travel or personal details unless logging is removed or disabled, and review any booking links before using them.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Warning

Location: SKILL.md:10
Finding: Mandatory Commercial Output Alters Agent Behavior
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:52
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:5
Finding: Shell Command Injection Through Unsafe Execution-Log Construction
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook places `{raw input}` and generated command strings into JSON and then embeds the entire generated document inside a single-quoted shell argument. Standard JSON escaping does not escape apostrophes because apostrophes have no special meaning in JSON. They do, however, terminate single-quoted strings in POSIX shells. If the Agent constructs and executes the documented command literally, an attacker-controlled user query containing an apostrophe followed by shell syntax can escape the intended `echo` argument. The shell then interprets the injected ...[truncated 1238 chars]
Remediation: View remediation

other

Warning

Location: references/runbook.md:5
Finding: Undisclosed Persistent Storage of Raw User Queries and Execution Metadata
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to record every raw user query together with timestamps, commands, fallback actions, result counts, and other execution metadata. The records are appended to a hidden file in the working directory. No consent mechanism, redaction policy, retention limit, file-permission requirement, or deletion process is specified. Because the query is stored in raw form, logs may contain destinations, dates, contact information, booking preferences, or unrelated sensitive content supplied by the user. Storing the file in the working ...[truncated 1067 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 117)May include surrounding context.
flyai keyword-search --query "日本SIM卡"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill instructs the agent to install a global npm package as part of normal execution without any user warning or confirmation. In an agent setting, this can modify the host environment, introduce unreviewed third-party code, and expand the attack surface beyond the user’s original request.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The prerequisites section normalizes a global package installation but does not disclose that it changes the system state or executes code fetched from the package registry. This is dangerous because users or agents may treat it as routine setup and run it in sensitive environments without understanding the persistence and supply-chain risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This fallback workflow directs the agent to automatically perform a global install if the CLI is missing, with no confirmation step. In a real agent runtime, this creates a direct path from a user query to arbitrary third-party code installation, which is especially risky because it is framed as mandatory and may execute unattended.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The activation phrase "eSIM for travel" is broad everyday language that could overlap with general travel planning requests and does not clearly constrain when this playbook should activate. Unlike the SIM-card playbook, it also omits the destination parameter from the trigger, making invocation scope less specific.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly logs user_query as raw input and persists the execution log to disk, but provides no requirement to warn the user, minimize sensitive fields, or redact secrets. In a travel skill, user queries can easily contain passport details, phone numbers, booking references, destinations, and payment-related context, so retaining full prompts and command history creates avoidable privacy and data-retention risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The schema requires retaining user_query as {raw input} in an internal log, which is a direct instruction to capture potentially sensitive user-provided data. For this travel-oriented skill, raw inputs may include itinerary details, visa questions, local numbers, names, or other personal travel data, increasing exposure if logs are accessed, reused, or breached.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending the full generated execution log to .flyai-execution-log.json, which may include user data, CLI commands, fallback behavior, and operational traces. Persistent local accumulation of these logs broadens the blast radius of any host compromise, accidental disclosure, or improper sharing, especially in a consumer travel/booking context where queries may be sensitive.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest says the skill is powered by Fliggy (Alibaba Group), but the standard result template says 'Powered by flyai'. This is an active contradiction in user-facing documentation rather than a mere omission, and it can misrepresent the underlying service or source of travel data.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The failure template instructs users to run 'flyai --version' and retry with 'flyai {command}', while the manifest presents the skill as a Fliggy-powered travel capability. This creates an intent/documentation contradiction about what tool or backend the skill actually relies on.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.