T01 · Skill Instruction Hijacking
Error
- Location
SKILL.md:8- Finding
Forced Commercial Output and Agent Instruction Hijacking
- Content
View full analysis
- Remediation
View remediation
Security audit
Winter Snow Travel
Security checks for vulnerabilities and agentic risk
Overview
The skill is a disclosed winter-travel booking helper, but it over-scopes activation and requires automatic use or installation of an unpinned global third-party CLI.
Review carefully before installing. This skill should only be used if you trust the FlyAI CLI and are comfortable sending travel queries through that provider, receiving booking-link-centered answers, and installing a global npm package. A safer version would pin the CLI version, install locally or in a sandbox, ask before installation, and narrow activation to explicit winter travel booking requests.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T08 · Insecure Dependencies
Error
- Location
SKILL.md:51- Finding
Mandatory Installation of an Unpinned Global npm Package
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)
Direct Prompt Extraction
High
- Category
- System Prompt Leakage
- Confidence
- 85% confidence
- Finding
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
- Content
flyai search-hotel --dest-name "Harbin" --key-words "温泉" --sort rate_desc
text ## Output Rules 1. **Conclusion first** — lead with the key finding 2. **Comparison table** with ≥ 3 results when available
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The activation list includes generic terms like "snow," "winter," and the Chinese phrase "冬天去哪," which are common in everyday travel queries and not specific enough to this skill's winter-snow booking workflow. Although one negative example is provided for ski-specific requests, the trigger scope remains broad and lacks stronger constraints or exclusion examples.
- Content