ClawHub
Back to skill

Security audit

Weekend Flights

Security checks for vulnerabilities and agentic risk

Overview

The skill is a travel-search helper, but it requires automatic global installation of an unpinned npm CLI before answering, which is a material environment-change risk.

Review before installing. This skill should only be used if you are comfortable with an agent installing and running a global npm package from @fly-ai. Prefer installing a reviewed, pinned version manually in an isolated environment, and treat returned booking links as third-party commercial links rather than neutral travel advice.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:8
Finding

Agent Behavior and Commercial Output Hijacking

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:40
Finding

Mandatory Installation and Execution of an Unpinned Global npm Package

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 152)May include surrounding context.

flyai search-flight --origin "Shanghai" --destination "Sanya" --dep-date 2026-05-02 --back-date 2026-05-04 --sort-type 3

text

## Output Rules

1. **Conclusion first** — lead with the key finding
2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to install a global npm package as a prerequisite, which modifies the host environment without requiring an explicit user confirmation or warning. In an agent/CLI context, automatic package installation creates supply-chain and system-integrity risk because a package install executes code and can persist tooling globally on the machine.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The workflow mandates attempting npm i -g @fly-ai/flyai-cli automatically when the command is missing, then continuing execution. This is dangerous because it turns a read/query task into an environment-changing action with no consent gate, exposing the system to unintended package execution, persistence, and possible compromise via dependency or registry abuse.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.