机票低价日历

• Outcome: Review
• Latest audit: May 29, 2026 · 9:31 PM UTC
• Version: 1.0.1

Overview

This flight-price skill is broadly legitimate, but it asks the agent to install an unpinned global CLI, bypass HTTPS certificate checks, and persist personal travel profile data, so it needs careful review before use.

Install only if you are comfortable with third-party FlyAI/Feizhu travel searches and local command execution. Avoid sudo/global @latest installs where possible, prefer a pinned reviewed CLI version, do not use NODE_TLS_REJECT_UNAUTHORIZED=0, and review or decline any saved travel profile in Qoder Memory or ~/.flyai/user-profile.md.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (14)

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill explicitly instructs operators to disable TLS certificate verification via `NODE_TLS_REJECT_UNAUTHORIZED=0` when SSL validation fails. That weakens transport security for all affected HTTPS requests and can enable man-in-the-middle interception or tampering of flight data, links, or any other exchanged information; in a travel-booking context this is especially risky because users may rely on returned prices and booking URLs.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The referenced documentation describes a generic AI travel search tool that supports hotels, attractions, trains, flights, and mixed itinerary planning, which is materially broader than this skill’s declared purpose of generating a low-price flight calendar. This scope mismatch can enable unintended capability exposure, confuse downstream agents about what actions are permitted, and increase the risk that the skill is invoked for out-of-scope travel planning tasks.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation explicitly exposes itinerary, hotel, attraction, and train search examples and capability descriptions that are unjustified for a flight-only low-price calendar assistant. In an agentic system, such excess capability references can lead to over-privileged use, accidental invocation of unrelated travel search functions, or prompt-surface expansion beyond the user-approved skill scope.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The documentation instructs operators to set NODE_TLS_REJECT_UNAUTHORIZED=0, which disables TLS certificate verification for the CLI process. This enables man-in-the-middle interception or spoofing of supposedly secure connections, allowing attackers to tamper with flight results, capture tokens, or redirect users to malicious content.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The reference file exposes a broad generic keyword-search capability covering visas, hotels, dining, tours, telecom, and other unrelated travel topics, while the skill is supposed to be a flight low-price calendar assistant. This scope mismatch can let the agent invoke functionality outside its declared purpose, increasing the chance of prompt steering, over-collection of user intent, and unauthorized feature expansion.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The reference file documents hotel-search functionality even though the skill is described as a flight low-price calendar assistant. This capability mismatch can mislead the agent into invoking unrelated tools or exposing broader travel-search behaviors than users and reviewers expect, increasing the risk of unintended data handling or scope creep.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: A hotel search capability is not justified by the stated purpose of finding the cheapest flight departure dates. Unnecessary capabilities violate least privilege and can cause the agent to perform unrelated actions or collect extra travel preferences, broadening attack surface and creating user-consent and data-minimization concerns.

Description-Behavior Mismatch

High

• Confidence: 97% confidence
• Finding: The referenced documentation describes a Marriott hotel search capability, while the declared skill is a flight low-price calendar assistant. This mismatch can cause an agent to invoke the wrong tool or trust incorrect parameters and outputs, leading to unsafe orchestration, data handling mistakes, and user deception about what the skill actually does.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The referenced documentation describes train search behavior even though the skill is advertised as a flight low-price calendar assistant. This mismatch can cause the agent to invoke the wrong capability, mishandle user intent, or return transportation results unrelated to the user's request, which is a real integrity and safety issue for agent behavior even if it is not direct code execution.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The document specifies persistent cross-session storage of detailed user travel profiles, which exceeds the stated purpose of a low-price flight calendar skill. Collecting and retaining profile data such as home city, family composition, budget, and travel history creates unnecessary privacy risk and expands the skill's capability surface beyond least privilege.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documented ability to create or update long-term user profiles in Qoder Memory is not necessary for answering which dates are cheapest to fly. Persisting personal preferences and family details in shared memory can expose sensitive information across sessions or tools and may violate user expectations if done without explicit, informed consent.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: The fallback design reads and writes a local file under ~/.flyai/user-profile.md, introducing filesystem access unrelated to the airfare-calendar task. This creates a stronger risk than in-memory session handling because it persists sensitive profile data on disk, may affect other flyai skills, and could overwrite or disclose local user information if the path is accessed broadly.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The markdown explicitly tells users to bypass SSL/TLS verification without an adequate warning that this defeats transport security. In practice, this normalizes insecure execution and materially increases the chance of interception, tampering, and data exposure whenever the CLI contacts remote services.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The query guidance permits highly generic natural-language searches and asks the agent to choose the 'best-matching' pattern from a wide set of categories. In an agent setting, this creates ambiguous tool-routing and makes it easier for user input to be transformed into unrelated searches, causing unintended actions and data access beyond the skill's advertised function.

VirusTotal

64/64 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.