Security audit

Plan Weekend Trips — Short Getaways, Weekend Flights, 2-Day Hotel Deals & Mini Vacations

Security checks for vulnerabilities and agentic risk

Overview

The skill is a travel planner, but it requires automatic global software installation, external CLI execution, commercial booking links, and hidden local logging without enough user control or disclosure.

Review this carefully before installing. It may install a global npm CLI, send your travel searches to an external service, show only results with booking links, and store raw trip queries in a local hidden log. Use it only in an isolated environment or after the publisher adds explicit consent, pinned dependencies, data-sharing disclosure, and safe logging controls.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Forced Commercial Output and Agent Goal Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:126
Finding: Mandatory Installation of an Unpinned Global npm Dependency
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/runbook.md:1
Finding: Raw User Query Persistence Through Unsafe Shell Interpolation
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook directs the Agent to store the user's raw query in a hidden local log and states that the log is not shown to users. There is no consent mechanism, redaction policy, retention period, access-control requirement, or size limit. The persistence example inserts generated JSON into a single-quoted shell argument. JSON escaping does not make text safe for shell interpolation. If a raw query contains a single quote, i ...[truncated 2015 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 192)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Hangzhou" --dep-date 2026-05-02 --back-date 2026-05-04 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The skill frames the agent as a 'CLI executor' and mandates command execution as the primary behavior, shifting it from a narrowly scoped weekend-trip planner into a shell-driven tool wrapper. In this context, broad execution-oriented behavior increases the chance of unsafe command use, privilege overreach, and abuse of the agent runtime beyond the user’s apparent travel-planning intent.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill instructs the agent to globally install and execute @fly-ai/flyai-cli via npm as a prerequisite to answering, which causes persistent system modification and execution of third-party code unrelated to the minimum necessary scope of a travel-planning skill. This is dangerous because it expands the trust boundary to the package registry and local shell, enabling supply-chain compromise or unintended host changes without explicit user consent.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill tells the agent to install software and run commands automatically if the CLI is missing, but provides no user-facing disclosure or consent flow for these host-level actions. That is dangerous because users requesting travel advice would not reasonably expect package installation and shell activity, creating a transparency and authorization gap that could be exploited or cause harmful system changes.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The playbooks instruct the agent to execute external travel-search commands and explicitly say 'never answer without executing,' which can cause user-origin, destination, and travel-date data to be transmitted to third-party services without clear user awareness or consent. In a travel skill this data flow is expected, but the lack of disclosure and the hard requirement to execute queries increases privacy and transparency risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, which can capture sensitive personal, travel, payment, passport, visa, or contact details without any minimization or user-facing notice. In a travel-booking skill, users are especially likely to submit PII and itinerary data, so persistent logging increases privacy exposure and downstream breach impact.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The runbook instructs persistent local file logging of execution data via appending to .flyai-execution-log.json without warning users that their data may be stored on disk. This creates a durable artifact that may be accessible to other local users, backups, support workflows, or later compromise, amplifying the effect of any sensitive data captured during travel planning and booking.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The template instructs users to rely on and invoke 'flyai' CLI and brands output as 'Powered by flyai', which conflicts with the stated Fliggy-powered weekend-trip skill. This kind of cross-product/tool mismatch is a supply-chain and social-engineering risk: users may be directed to install, trust, or execute the wrong tool, and troubleshooting steps explicitly normalize command execution based on untrusted template content.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The trigger for Playbook A is only provided in Chinese ("周末去哪玩"), while the rest of the file is otherwise in English and does not state that the skill is intentionally limited to Chinese-speaking users or a Chinese locale. This creates a language-specific activation policy without opt-in or justification.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.