Security audit

Unique Homestay

Security checks for vulnerabilities and agentic risk

Overview

The skill is a homestay search helper, but it requires an unpinned global CLI install and quietly persists raw travel queries and command history, so it should be reviewed before installation.

Install only if you are comfortable with a globally installed flyai npm CLI handling your travel searches and returning booking links. Before use, require explicit approval for any package installation, pin and verify the CLI version, disable or remove the .flyai-execution-log.json logging behavior, and treat all booking URLs as third-party links that need validation before payment or sign-in.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:73
Finding: Mandatory Installation of an Unpinned Global npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:3
Finding: Undisclosed Persistence of Raw User Queries and Command History
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook instructs the agent to retain the user's raw input, collected parameters, executed commands, and recovery commands in `.flyai-execution-log.json`. It explicitly states that this internal logging is not shown to users, but it provides no consent mechanism, privacy notice, redaction policy, retention period, access-control requirement, encryption, or deletion procedure. Travel queries may reveal destinations, dates, budgets, nearby points of interest, accommodation preferences, and other behavioral data. Persisting this information in plaintext creates a cross-session privacy exposure. The proposed shell command also embe ...[truncated 1827 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.
flyai search-hotel --dest-name "Dali" --hotel-types "民宿" --sort rate_desc --check-in-date 2026-05-01 --check-out-date 2026-05-03

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest description says the skill supports flights, hotel reservations, train tickets, attraction tickets, itinerary planning, visa info, travel insurance, car rental, and more. However, the documented code/workflow in this file only defines activation, parameters, and CLI commands for homestay/hotel search via flyai search-hotel, with no corresponding workflows for those other capabilities.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The runbook explicitly captures the raw user query and every CLI command in an internal execution log, which exceeds what is necessary for a travel-booking skill. Because travel queries may include personal, financial, or itinerary details, persistent collection of this data increases privacy exposure and creates a useful audit trail for misuse or later compromise.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook normalizes collection and persistence of raw user input and execution details without any privacy notice, consent flow, minimization guidance, or retention controls. In a travel context, users commonly disclose destinations, dates, names, and other personal information, so silent logging materially raises privacy and compliance risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Persisting the user_query field stores raw user input directly, which may include sensitive travel plans, contact details, or other personal data. Keeping such data in internal logs expands the attack surface and can expose users even if the primary booking flow is otherwise secure.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook instructs appending execution logs to a local file, creating durable storage of potentially sensitive operational and user-derived data. For a homestay/travel assistant, filesystem persistence is not essential to core functionality and increases the risk of unauthorized access, retention beyond need, and secondary exposure through backups or host compromise.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: Persistent storage of execution logs compounds the sensitivity of any recorded user input, commands, and operational data by making them durable and easier to collect at scale. This is especially risky for a travel assistant because logs may indirectly reveal identities, schedules, destinations, and booking intent.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The Parameters table states --sort is always rate_desc, implying the skill only sorts by guest ratings. But later sections define valid sort options including price and distance, and Playbook B explicitly uses price_asc, contradicting the earlier instruction.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

Category: Not specified by scanner
Confidence: 84% confidence
Finding: The execution schema includes an env_check step that runs flyai --version, which is a form of local environment introspection. For a skill whose purpose is travel search and booking, checking host CLI state is not user-facing functionality and is not justified by the manifest description.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.