Security audit

Water Park Guide

Security checks for vulnerabilities and agentic risk

Overview

The skill can find water parks, but it also directs agents to install and rely on an unpinned global travel-booking CLI and force booking links into responses.

Review before installing. Only use this skill if you are comfortable installing and running the FlyAI CLI globally, receiving booking-link-centered results, and relying on that provider as the source of travel data. Prefer approving any install manually, pinning or verifying the package, and running it in a restricted environment.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:8
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:40
Finding: Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:67
Finding: Potential Shell Command Injection Through User-Controlled City Interpolation
Content: View full analysis
" ``` The top-rated search template follows the same pattern: ```bash flyai search-poi --city-name "{city}" --category "" --poi-level 5 ``` The category placeholder above represents the fixed water-park category literal in the original file; the vulnerable value is the user-controlled `{city}` interpolation. ### Technical Analysis The workflow tells the agent to collect a city from the user and substitute it into a command template. No validation rules, escaping requirements, or argument-array execution mechanism are defined. Quoting an interpolated value with double quotes is not sufficient protection when a command is passed through a shell. Shell constructs such as command substitution can still be evaluated inside double quotes. For example, a crafted city containing a substitution expression could execute a secondary command before `flyai` receives its arguments. Exploitability depends on the agent's command-execution interface. If the command is invoked directly with a structured argument array and without a shell, shell metacharacters remain ordinary argument data. If the rendered template is executed through a shell, command injection is possible. The skill does not require the safer execution mode and therefore leaves an exploitable execution path. ### Attack Path 1. An attacker submits a water-park request with a malicious city value containing shell syntax. 2. The skill collects the value without enforcing an allowlist or canonical city format. 3. The agent substitutes the value into the documented command string. 4. The agent sends the rendered string to a shell-based executio ...[truncated 960 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration

Findings (4)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 120)May include surrounding context.
flyai search-poi --city-name "Guangzhou" --category "水上乐园"

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The skill is presented as a narrow water-park finder, but it directs the agent to install and use a broad travel-booking CLI with capabilities far beyond the declared scope. This scope mismatch increases the attack surface and can mislead users or host agents into granting tool access and handling actions unrelated to the requested function.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates global installation of an external npm CLI for a simple lookup task, which introduces supply-chain risk and grants code execution on the host environment. Requiring installation as part of normal skill flow is especially dangerous because the package executes with the user's privileges and may change the system state persistently.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The instruction to run npm i -g @fly-ai/flyai-cli without warning or confirmation authorizes a privileged, persistent system modification without user consent. In an agent setting, this can be abused to install untrusted code, alter environment behavior, or create a foothold for further compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.