Security audit

中转不浪费

Security checks for vulnerabilities and agentic risk

Overview

The skill is a coherent travel planner, but it asks for risky command execution and automatic profile access that users should review before installing.

Install only if you are comfortable with FlyAI travel searches, booking links, and persistent travel-profile data. Do not allow sudo or global @latest package installation without verifying the package, do not disable TLS certificate validation, and review or delete stored profile data if you do not want travel preferences reused.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (13)

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The referenced capability is a broad AI travel search interface that accepts arbitrary natural-language travel queries, while the skill manifest promises a narrowly scoped transit-layover tour planner. This mismatch can cause the agent to invoke a more powerful tool than intended, leading to scope creep, unreliable behavior, and possible handling of requests outside the skill’s declared purpose without proper guardrails.

Description-Behavior Mismatch

High

Confidence: 95% confidence
Finding: The documented capability is for hotel search, which materially diverges from the skill's declared purpose of finding long-layover flight options and generating transit tour plans. This kind of scope mismatch is dangerous because it can enable undisclosed data handling or tool use beyond user expectations, increasing the risk of unauthorized actions, privacy issues, or prompt-routing abuse.

Context-Inappropriate Capability

Medium

Confidence: 86% confidence
Finding: Hotel search may be adjacent to travel, but in this skill's stated context it is not clearly necessary for finding layover-friendly flights or computing safe half-day transit itineraries. Unjustified extra functionality broadens the attack surface and can lead to over-collection of user travel details or invocation of capabilities the user did not intend to authorize.

Description-Behavior Mismatch

High

Confidence: 97% confidence
Finding: The referenced capability in this file is for Marriott package and hotel-related search, which does not match the declared skill purpose of finding layover-friendly transit flights and generating transit-tour itineraries. This kind of skill-definition mismatch can cause the agent to invoke unrelated tools, return misleading results, or expose users to unintended domains and data flows, undermining trust and creating opportunities for prompt-routing abuse or unsafe automation behavior.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The document defines cross-skill persistent user-profile storage for a transit-tour assistant, which exceeds the minimum data needed to find long-layover flights and generate stopover plans. This creates unnecessary retention and reuse of personal travel data across contexts, increasing privacy risk and the blast radius if the data is later accessed by unrelated skills or exposed from local storage/memory.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The specified fields include broad personal and behavioral data such as family composition, budget, accommodation preferences, and travel history, which are not clearly required for a stopover sightseeing assistant. Over-collection increases privacy exposure and can enable sensitive inference about the user without strong necessity or consent.

Context-Inappropriate Capability

Medium

Confidence: 80% confidence
Finding: The workflow requires a global install/upgrade of a CLI before any search, which is excessive for the stated travel-planning purpose and increases supply-chain and host-modification risk. Forcing users or agents to pull and execute the latest package globally creates unnecessary exposure to compromised packages, breaking changes, or privilege-related side effects.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: The instruction to set NODE_TLS_REJECT_UNAUTHORIZED=0 disables TLS certificate validation, making HTTPS connections vulnerable to man-in-the-middle attacks. In a skill that fetches travel and booking data, this could expose users to tampered results, malicious links, and interception of sensitive queries or session data.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The trigger phrases are broad and overlapping, which can cause the skill to activate in situations where the user did not clearly request this specific capability. Unintended invocation matters here because the skill is designed to read user history at startup, so an over-broad trigger increases the chance of unnecessary access to personal travel-preference data.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill explicitly states that it reads historical user preferences on startup, but it does not present this as an opt-in or clearly warn the user before doing so. This creates a privacy risk because personal profile data may be accessed automatically even when it is not necessary for the current request.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The spec instructs the skill to read and write persistent user profile data but does not require a clear upfront disclosure that information may be stored beyond the current session. Without explicit privacy notice and consent, users may unknowingly provide personal data that is retained locally or in shared memory systems.

Missing User Warnings

High

Confidence: 99% confidence
Finding: This workflow explicitly instructs operators to bypass TLS certificate validation without any strong warning, normalizing an unsafe practice. Because the skill also depends on returned booking URLs and external search results, disabling TLS materially raises the chance of data tampering and malicious redirection.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The startup instruction to query memory or read a local profile file can expose previously stored personal information beyond what is needed for the current travel-planning request. This is especially risky because the access happens by default and includes a filesystem fallback, increasing the chance of retrieving sensitive data without user awareness or necessity.

Static analysis

No suspicious patterns detected.