T08 · Insecure Dependencies
Error
- Location
reference/core-workflow.md:5- Finding
Unpinned Global Package Installation with Optional Root Privileges
- Content
View full analysis
- Remediation
View remediation
Security audit
一键抄作业
Security checks for vulnerabilities and agentic risk
Overview
The skill is a coherent travel-planning helper, but it tells agents to install mutable global software and run travel searches with TLS verification disabled, which needs careful review before use.
Install only if you are comfortable reviewing and changing the workflow first: remove `NODE_TLS_REJECT_UNAUTHORIZED=0`, avoid `sudo` and mutable global installs, validate or restrict source URLs and booking URLs, escape generated HTML content, and use explicit controls for storing or deleting the travel profile.
Vulnerability Patterns
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (7)
T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:126- Finding
TLS Certificate Verification Disabled for FlyAI Operations
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
reference/core-workflow.md:74- Finding
Shell Command Injection Through Interpolated User and Web Content
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Error
- Location
reference/html-template.md:490- Finding
HTML and URL Injection in Generated Itinerary Files
- Content
View full analysis
{{departure date}} {{departure time}} {{departure city}}→{{destination}}✈️ {{activity title}}
{{activity description}}
{{hotel name}}{{hotel description}}
✈️ Book flight 🏨 Book hotel ``` The generation instructions require direct placeholder replacement: ```python html_content = """ ... replace all variables with actual values ... """ create_file( file_path="/Users/xxx/Desktop/destination-itinerary-2026-04-04.html", file_content=html_content ) ``` ### Technical Analysis Values originating from users, fetched webpages, and FlyAI responses are inserted into HTML text and attributes. The template does not require context-sensitive escaping, sanitization, URL parsing, scheme restrictions, or hostname validation. A value containing HTML markup can terminate its intended context and add elements or event handlers. A booking response can also provide a `javascript:`, `data:`, or deceptive HTTPS URL. When the generated file is opened, injected content executes or appears in the trusted-looking itinerary. Links opened with `target="_blank"` also omit `rel="noopener noreferrer"`, which can expose the originating window to reverse-tabnabbing in browser environments that do not implicitly isolate it. ### Attack Path 1. An attacker creates a travel page containing a crafted activity description, author name, hotel name, or destination. 2. The user asks the Skill to convert that page into an itinerary. 3. The Skill extracts ...[truncated 956 chars]- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
reference/html-template.md:686- Finding
Third-Party JavaScript Loaded Without Subresource Integrity
- Content
View full analysis
``` ### Technical Analysis Every generated itinerary loads and executes JavaScript from a third-party CDN when the document is opened. Although the package version is specified, the resource has no Subresource Integrity hash. Without an `integrity` attribute, the browser cannot verify that the downloaded resource matches a reviewed artifact. Compromise of the CDN, package publication path, DNS resolution, or TLS trust environment could cause modified JavaScript to execute inside generated itineraries. The risk is amplified because the HTML files contain travel dates, destinations, budgets, flight details, and hotel details. ### Attack Path 1. An attacker compromises the CDN delivery path or the published asset for the referenced version. 2. A user opens a generated itinerary while connected to the network. 3. The browser downloads the modified `html2canvas` resource. 4. No integrity hash is available to detect the modification. 5. The attacker's JavaScript executes in the document. 6. The script reads itinerary contents, changes displayed booking links, or sends available information to a remote server. ### Impact Assessment Successful exploitation affects users opening generated HTML files while the compromised resource is served. It can expose itinerary contents and alter browser-visible booking actions. This issue does not by itself grant native host privileges, but it enables arbitrary browser-side code execution within the generated document's security context. ]]>- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
reference/user-profile-storage.md:68- Finding
Personal and Family Travel Profile Stored in Predictable Plaintext
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
reference/core-workflow.md:30- Finding
Unrestricted Retrieval of User-Supplied URLs
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Findings (70)
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The workflow explicitly instructs use of NODE_TLS_REJECT_UNAUTHORIZED=0, which disables TLS certificate verification for network commands. This makes FlyAI requests vulnerable to man-in-the-middle interception or tampering, allowing attackers to spoof upstream services, alter search results, or capture user travel queries and related data.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The command disables TLS verification without any user warning, normalizing an insecure transport default. Users may unknowingly run network searches over a connection that cannot authenticate the remote endpoint, exposing the request and response stream to interception or manipulation.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The flight search example disables TLS verification for a command handling itinerary and date information. An attacker on the network path could tamper with returned flight data or harvest user travel plans, which is especially risky in a travel-booking workflow that may influence downstream booking decisions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The hotel search example suppresses certificate verification, weakening confidentiality and integrity for travel search traffic. This could enable response spoofing, manipulation of hotel availability/pricing information, or interception of destination and schedule details.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The POI search command also disables TLS verification without warning, creating the same man-in-the-middle exposure as the other search commands. In this context, tampered POI data could mislead users about destinations, hours, or availability and degrade trust in generated itineraries.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The document explicitly instructs users to set NODE_TLS_REJECT_UNAUTHORIZED=0 for all FlyAI commands, which disables TLS certificate validation globally for the Node process. This enables man-in-the-middle interception or tampering of API traffic, including search results and returned booking links, and is especially risky because the instruction is presented as a required default rather than a narrowly scoped troubleshooting step.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
The documentation tells users to disable TLS certificate verification for every command and provides no warning about the security consequences. This normalizes insecure transport behavior and can cause downstream users or agents to retrieve flights, hotels, POIs, and booking URLs over connections that cannot authenticate the remote server.
- Content
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </head> <body> <div class="container"> <!-- 头部 --> <div class="header"> <h1>🌴 {{目的地}}攻略</h1> <div class="meta">{{出发城市}}出发 · {{日期区间}} · {{天数}}天{{晚数}}晚 · {{人数}}人</div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <span class="day-theme">{{Day1主题}}</span> </div> <div class="day-content"> <!-- 时间线项目 --> <div class="timeline-item"> <div class="time-badge"> <span class="time">{{时间1}}</span>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </div> <!-- 更多 Day 卡片... --> <!-- 按相同格式重复 day-card --> <!-- 费用总览 --> <div class="budget-card">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md </div> <!-- 更多 Day 卡片... --> <!-- 按相同格式重复 day-card --> <!-- 费用总览 --> <div class="budget-card">
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <td class="original">{{差异2原内容}}</td> <td class="adapted">{{差异2调整}}</td> </tr> <!-- 更多差异行... --> </tbody> </table> </div>
Hidden Instructions
High
- Category
- Prompt Injection
- Confidence
- 70% confidence
- Finding
Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.
- Content
md <td class="original">{{差异2原内容}}</td> <td class="adapted">{{差异2调整}}</td> </tr> <!-- 更多差异行... --> </tbody> </table> </div>
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The shell example provides an unsafe command that disables certificate verification with no warning, normalization, or compensating control. Because examples in operational docs are often copied verbatim, this can propagate insecure defaults into real agent behavior and expose all HTTPS requests in that process to interception.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
This is another copy-pasteable insecure shell example that suppresses TLS certificate checks without any safety warning. In the skill context, it is especially risky because the agent may fetch and rely on untrusted external travel data, so tampered responses could directly influence generated itineraries and booking suggestions.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 99% confidence
- Finding
This guidance normalizes disabling certificate verification without any meaningful warning, making an insecure transport bypass the documented default for routine operations. Users following the documentation may unknowingly expose itinerary searches and returned data to interception, tampering, or service impersonation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
该描述中的触发词包含“帮我抄这个”“把这篇变成我的攻略”等宽泛自然语言，缺少明确上下文约束，容易与普通对话重叠。文档也没有提供排除条件或负例来界定哪些表述不应激活该技能。
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The memory workflow explicitly tells the agent to remember and reuse user travel profile information, and to fall back to reading a local profile file, without clear minimization or consent boundaries. This creates a data retention risk because personal preferences and potentially sensitive travel patterns may be stored or retrieved more broadly than the user expects.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill instructs the agent to read and persist user profile data such as departure city, companions, and budget preferences without clearly requiring notice, consent, retention limits, or scope restrictions. In a travel-planning context this can lead to silent collection and reuse of personal data across sessions, creating privacy and compliance risk.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 99% confidence
- Finding
Requiring
NODE_TLS_REJECT_UNAUTHORIZED=0disables TLS certificate validation for FlyAI commands, allowing man-in-the-middle interception or tampering of traffic to external services. In this skill, those requests may include itinerary contents, user profile attributes, and booking-related results, so the context makes the issue more dangerous by exposing both sensitive data and integrity of travel recommendations.- Content
md - **fetch_content**：解析攻略链接 - **Browser Agent**：动态页面备选方案 > ⚠️ FlyAI 命令需加 `NODE_TLS_REJECT_UNAUTHORIZED=0` 前缀 ---
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The workflow requires globally installing/upgrading a CLI from npm and even suggests sudo when permissions fail. Global package installation increases supply-chain and system-wide impact, and encouraging sudo raises the risk of privileged execution of package lifecycle scripts or a compromised package version.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 88% confidence
- Finding
The workflow advises use of sudo for npm global installation. Running npm install with root privileges can execute package install scripts as root, magnifying the impact of a malicious or compromised dependency and increasing the chance of host compromise.
- Content
md | 情况 | 处理方式 | |-----|---------| | npm 未安装 | 提示用户先安装 Node.js (https://nodejs.org/) | | 权限不足 | 建议使用 `sudo npm install -g @fly-ai/flyai-cli@latest --registry=https://registry.npmjs.org` 或使用 nvm 管理 Node | | 网络问题 | 建议用户检查网络，确保可以访问 registry.npmjs.org | ### 阶段1: 内容解析 (Parsing)
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The Browser Agent is instructed to extract and return all information from the page in complete detail, with no data-minimization boundary. If the source page or linked content contains personal data, contact details, booking references, or other sensitive material, the skill may over-collect and echo unnecessary data back into the conversation or logs.
- Content
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
Setting NODE_TLS_REJECT_UNAUTHORIZED=0 establishes an unsafe default by turning off certificate validation. Even if used for convenience, this trains operators to bypass transport security whenever issues arise, increasing the likelihood of interception and silent data tampering.
- Content
方式D：口述匹配 用户描述模糊时，用 FlyAI 搜索匹配：
bash NODE_TLS_REJECT_UNAUTHORIZED=0 flyai keyword-search --query "[用户口述关键词]"1.2 输出解析结果
Unsafe Defaults
Medium
- Category
- Tool Misuse
- Confidence
- 98% confidence
- Finding
The documented default for the flight lookup command disables TLS checks, weakening a core security control for network communication. Because this workflow processes user-origin, destination, and date data, the insecure default exposes sensitive trip metadata and undermines result integrity.
- Content
2.1 验证航班/交通
bash NODE_TLS_REJECT_UNAUTHORIZED=0 flyai search-flight \ --origin "[用户出发城市]" --destination "[目的地]" \ --dep-date [用户日期] --back-date [返回日期] --sort-type 3