T08 · Insecure Dependencies
Warning
- Location
README.md:139- Finding
Unpinned Third-Party Packages and Mutable Skill Source
- Content
View full analysis
- Remediation
View remediation
Security audit
easytravelwithchild
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its family-travel purpose, but its documented setup pulls mutable third-party code and installs a global CLI, so users should review the install path first.
Review and pin the installer, remote skill revision, and flyai-cli version before installing. Use a least-privileged environment, and assume destination, dates, budget, family details, and search keywords may be sent to FlyAI/Fliggy and reflected in commercial booking links.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (14)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
声明描述的是较完整的亲子出行规划与决策能力，涵盖儿童场地适配、陪伴判断、周边方案和酒店比较等。实际代码只完成了基于关键词的亲子酒店搜索与结果展示，主要资源访问也是 flyai 的关键词搜索结果，并输出预订链接。虽然与“亲子酒店”场景部分相关，但核心能力范围明显更窄，且缺少声明中的多个关键功能，因此描述与实际行为存在实质性不匹配。
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
描述强调的是亲子出行决策与推荐能力，包含针对儿童特征的个性化推荐、酒店游乐设施筛选、陪同判断和周边方案规划等较强的分析能力。但代码实际仅接收一个查询词，调用外部搜索接口返回结果，然后按简单规则分成酒店/套餐/其他三类并打印基础字段与预订链接。它没有读取孩子年龄、性别、性格等参数，也没有进行亲子设施质量评估、同类对比、陪同需求判断或周边规划。因此其实际行为与声明用途存在明显且实质性的功能不匹配。
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
This README is entirely written in Chinese and all example invocations, parameter descriptions, and usage guidance assume Chinese-language interaction. Under the policy, a language or locale constraint should either be optional for the user or explicitly documented as justified; neither is stated here.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 88% confidence
- Finding
The README instructs users to run
npx ali-skillswithout pinning an exact package version, which can cause execution of whatever package version is current at install time. If the upstream package is compromised, malicious, or introduces breaking behavior, users may unknowingly execute unreviewed code during installation or setup.- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The trigger scope is broad enough that the skill may activate on generic family-travel requests without clear user intent for this specialized workflow. Overbroad activation can cause unintended tool usage, unnecessary external queries, or irrelevant transactional nudging, especially since the skill is designed to perform scripted searches and booking-oriented output.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest and instructions are entirely written in Chinese and prescribe Chinese-language query patterns and output examples, but do not state that the skill is region-specific or offer an opt-in language choice. This can constitute a language or locale policy violation because it effectively forces a specific language without user consent.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The 'When to Use' section relies on ambiguous phrases like 带娃/遛娃/亲子游 without boundary conditions, which increases the chance of accidental invocation. In context, this matters because the skill instructs downstream scripted retrieval and recommendation generation, so mistaken activation could lead to unwanted data fetches or commercially biased outputs.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The natural-language interface, help text, examples, and output strings are all in Chinese, which effectively forces a specific language/locale on users. The file does not offer user opt-in or selection of language, and no region-specific justification is documented.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The script sends user-supplied travel details such as city, dates, price range, and family-oriented keywords to an external CLI-backed service without any notice, consent, or data-minimization step. While this is expected for a search feature, it still creates a real privacy risk because potentially sensitive itinerary information is transmitted off-host and may be logged by the CLI, provider, or network infrastructure.
- Content
Natural-Language Policy Violations
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script’s title, usage text, option descriptions, examples, and all user-facing guidance are presented only in Chinese, which imposes a specific language on users without any opt-in or alternative. Under the policy, language constraints should either offer choice or be clearly justified as region-specific.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The manifest describes a planning-oriented skill for selecting hotels with free children's playgrounds, comparing similar hotels, recommending venues by child traits, and judging supervision needs. This script instead searches for vacation packages via
flyai keyword-search, classifies results into hotels/packages/products, and prints direct booking links, which shifts the behavior toward travel product/package search and booking referral rather than the stated planning and recommendation scope.- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The entire skill reference is presented only in Chinese, with no indication that users may choose another language or locale. Under the policy for natural-language violations, forcing a specific language without user opt-in can be a locale-policy issue.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
SQP-3 applies to all file types and covers language or locale policy violations. This file presents all instructions and guidance only in Chinese, with no indication that users may choose another language or that Chinese is required for a justified region-specific use case.
- Content
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 86% confidence
- Finding
The file header and examples repeatedly frame the script as searching for '度假套餐' and '套票', emphasizing package discovery. That documented intent diverges from the skill manifest's narrower description centered on hotel filtering, venue recommendation, and supervision guidance for families traveling with children.
- Content