Security audit

Travel Simcard

Security checks across malware telemetry and agentic risk

Overview

This travel SIM skill is not clearly malicious, but it should be reviewed because it tells agents to install an unpinned global npm CLI automatically and to persist raw travel queries in a local log.

Install only if you trust the flyai npm package and are comfortable with a global CLI being installed and used for provider-specific booking links. Before use, prefer installing the CLI yourself, review or disable `.flyai-execution-log.json` logging, and avoid entering sensitive passport, visa, payment, or detailed itinerary data unless you understand where the CLI and logs may send or store it.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The runbook explicitly captures the raw user query in an internal execution log, which can contain personal, financial, itinerary, passport, visa, or other sensitive travel-related information. For a travel SIM and booking skill, retaining raw input is not necessary for core functionality and creates unnecessary data exposure risk if logs are accessed, reused, or leaked.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The runbook instructs the agent to append execution logs to a local file when filesystem access is available, creating durable storage of potentially sensitive operational data. This persistence is unrelated to the skill's advertised booking and travel assistance purpose and increases the chance of unauthorized access, cross-session data leakage, or later misuse.

Vague Triggers

Medium

Confidence: 82% confidence
Finding: The manifest advertises broad travel-booking capabilities, which can cause the skill to activate outside its actual SIM-card scope. In agent ecosystems, overly broad activation increases the chance of unintended tool execution, including networked CLI calls for unrelated user requests, expanding the attack surface and risking unsafe or irrelevant actions.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install and run a global npm package automatically, which implies network access and persistent modification of the host environment without requiring user consent. This is dangerous because a prompt-triggered skill can turn a simple query into software installation and execution of third-party code, creating supply-chain and system-integrity risks.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The prerequisite block directs a global npm install with no user-facing disclosure that it will download and persist software on the machine. Because npm packages execute code during installation and later runtime, this creates a clear supply-chain and host-modification risk when embedded in an agent skill.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The workflow explicitly mandates automatic installation if the CLI is missing, meaning the agent may modify the system and execute newly downloaded code solely based on skill logic. In context, this is more dangerous than a passive prerequisite because it operationalizes self-install behavior during routine handling of user queries, increasing the likelihood of unapproved code execution.

Natural-Language Policy Violations

Medium

Confidence: 94% confidence
Finding: The playbook hardcodes a Chinese-language search query ("SIM卡 {dest}") regardless of the user's language, locale, or market intent. This can bias results toward Chinese-language inventory or Fliggy-specific content, causing the agent to miss relevant options, return less understandable results, or steer users into a marketplace they did not intend to use.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The schema combines collection of raw user input with optional disk persistence and provides no user-facing notice, consent flow, or privacy controls around retention. In this skill context, users may submit highly sensitive travel details, making silent logging more dangerous because it can expose location history, booking preferences, identifiers, and other personal data beyond what is needed to answer the request.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.