酒店三选一

• Outcome: Review
• Latest audit: May 27, 2026 · 10:39 PM UTC
• Version: 1.0.1

Overview

The hotel-picking purpose is mostly coherent, but the skill asks agents to install an unpinned global CLI and disables TLS certificate checks for travel searches.

Review before installing. Use this only if you trust the FlyAI CLI, prefer a pinned/local install instead of global @latest, do not run sudo install through the agent, and do not accept TLS certificate bypass for normal searches. Also decide whether you are comfortable storing travel preferences, budget, companions, and special needs in memory or ~/.flyai/user-profile.md.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to perform a global install/upgrade of a CLI before hotel lookup, which exceeds the minimum capability needed for the declared task and changes the host environment. This creates unnecessary supply-chain and system-modification risk, especially because it runs package installation from the network and can affect other workflows on the machine.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill directs use of NODE_TLS_REJECT_UNAUTHORIZED=0 for hotel and POI searches, disabling TLS certificate validation for network requests. This permits man-in-the-middle interception or tampering of responses and credentials, which is especially unsafe for travel-related searches that may influence bookings or expose user data.

Description-Behavior Mismatch

Medium

• Confidence: 85% confidence
• Finding: The skill description presents a hotel comparison assistant, but the implementation also reads and later saves user travel profile data. This scope expansion increases privacy risk because users may not reasonably expect persistence or retrieval of historical preference data from a simple hotel-picking skill.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: Reading a local profile file and writing preference memory introduces persistent access to user data that is not directly required to compare hotels in the current session. That broadens the skill's authority and raises confidentiality and data-minimization concerns if the data is stale, sensitive, or reused without clear consent.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The referenced documentation exposes a generic travel keyword-search capability rather than a narrowly scoped hotel comparison helper. This mismatch can cause the agent to invoke functionality outside the declared purpose, weakening least-privilege boundaries and increasing the chance of unintended data access, misleading behavior, or policy bypass through off-scope travel queries.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill documentation includes unrelated domains such as visas, telecom, cruises, and tours, which materially broaden the operational scope beyond hotel picking. In the context of a hotel decision assistant, this expanded surface makes prompt steering and tool misuse more likely, allowing users or downstream prompts to pivot the agent into actions or recommendations not covered by its intended trust boundary.

Description-Behavior Mismatch

High

• Confidence: 94% confidence
• Finding: The reference file documents a flight-search tool even though the skill is described as a hotel-selection assistant. This mismatch can cause the agent to invoke or expose unrelated capabilities, leading to confused-deputy behavior, unintended data handling, or incorrect task execution when users ask for hotel advice.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The document instructs the skill to persistently read and write a reusable user travel profile across sessions, which exceeds the narrow hotel-comparison purpose described in the skill metadata. This creates unnecessary data collection and retention risk because sensitive preference and family information can be stored beyond the immediate user request and reused in other contexts.

Context-Inappropriate Capability

Medium

• Confidence: 96% confidence
• Finding: The documented ability to create and update Qoder memory entries and local files gives the skill persistent state management that is not justified by simply comparing hotels. Unnecessary write capability broadens the attack surface, enabling silent accumulation of personal data and possible cross-context misuse if other skills or processes read the same storage.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill tells the agent to run a global install/upgrade command without meaningful warning about system changes, package trust, or supply-chain risk. Users may be exposed to unexpected software modification and dependency compromise because the action is framed as mandatory for a simple recommendation task.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The document recommends bypassing certificate validation for network requests and does so without a strong safety warning or restricted emergency-only context. Because this weakens a core transport security control, it materially increases the chance of traffic interception and manipulated search results.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The file describes reading and storing persistent user profile information, including city, airport, budget, family composition, history, and special needs, but does not present explicit privacy notice, retention period, or data handling constraints. Users may unknowingly expose personal and potentially sensitive travel-profile data that remains on disk or in shared memory stores longer than expected.

Session Persistence

Medium

• Category: Rogue Agent

Content

如果 `~/.flyai/` 目录不存在，需要先创建：
```bash
mkdir -p ~/.flyai
```

### 文件格式

• Confidence: 91% confidence
• Finding: The guidance to create and use ~/.flyai/user-profile.md establishes local session persistence for personal profile data on the host filesystem. In the context of a hotel-picking skill, this is more dangerous because it normalizes durable storage of personal travel preferences and family details in a predictable location that other local tools or users may access.

Static analysis

No suspicious patterns detected.