周末去哪儿

• Analyzed: Apr 4, 2026, 1:11 AM
• Findings: 1
• Version: 1.0.1
• Hash: 144d70a2cb3afdd274c03fbe840b918d19dd68c0022d9281d3abae900b91540e
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious due to high-risk operational instructions found in workflow.md. It directs the AI agent to perform a global npm installation (npm install -g @fly-ai/flyai-cli), which executes remote code with potentially elevated privileges, and explicitly instructs the agent to bypass SSL certificate validation (NODE_TLS_REJECT_UNAUTHORIZED=0), introducing a Man-in-the-Middle (MitM) vulnerability. While these actions appear intended to ensure the travel tool functions across different environments, they constitute significant security flaws. The skill also reads and writes user travel preferences to ~/.flyai/user-profile.md as detailed in user-profile-storage.md.