Back to skill

Security audit

pilgrimage-travel

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill is coherent in purpose, but it requires automatic global installation and execution of an unpinned third-party CLI using user-derived shell command templates.

Install only if you are comfortable with a skill that can install and run a global third-party npm CLI for travel searches. Prefer requiring explicit approval before installation, pinning and verifying the package, running it in a sandbox, and validating all travel inputs before any command execution.

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:13
Finding

Forced Agent Role Override and Commercial Output Hijacking

Content
View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` `SKILL.md:137-145`: ```markdown ## Output Rules 1. **Conclusion first** — lead with best option 2. **Pilgrimage tip — Lhasa, Bodh Gaya, and Mecca are major pilgrimage destinations** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` `references/templates.md:32-46`: ```markdown ## Output Template ```markdown ## Flight Search Results | # | Airline | Route | Departure | Duration | Price | | |---|---------|-------|-----------|----------|-------|-| | 1 | {airlineName} | {origin} -> {destination} | {depTime} | {duration} | Y{price} | [Book]({{detailUrl}}) | Powered by flyai - Real-time pricing, click to book ``` ## Notes - Always include [Book](detailUrl) links - Format prices in CNY (Y) - Include at least 3 results when ...[truncated 2078 chars]
Remediation
View remediation

T08 · Insecure Dependencies

Warning
Location
SKILL.md:66
Finding

Mandatory Global Installation of an Unpinned Third-Party npm Package

Content
View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` ``` `references/fallbacks.md:3-10`: ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ **NEVER proceed without CLI. NEVER fabricate results.** ``` `references/fallbacks.md:21-25`: ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The Skill mandates installation of `@fly-ai/flyai-cli` from the npm registry when the command is unavailable. The package is installed globally and no exact version, integrity digest, lockfile, verified distribution source, or reviewed package source is supplied. npm packages can execute lifecycle scripts during installation. A global installation also modifies the user's broader environment and makes the resulting executable available outside the immediate Skill run. Consequently, compromise of the package, publisher account, registry resolution, or a future release can turn this installation step into arbitrary code execution. The repository contains no copy of the package implementation, so its filesystem access, telemetry, network destinations, and credential handling cannot be verified through this audit. ### Attack Path 1. The Skill is invoked on a system where `flyai` is not installed. 2. The mandatory environment check reports `command not found`. 3. The Agent executes `npm i -g @fly-ai/flyai-cli`. ...[truncated 1151 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:91
Finding

Shell Command Injection Through User-Controlled Travel Parameters

Content
View full analysis
Remediation
View remediation
Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (11)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 142)May include surrounding context.

flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text

## Output Rules

1. **Conclusion first** — lead with best option
2. **Pilgrimage tip — Lhasa, Bodh Gaya, and Mecca are major pilgrimage destinations**

Ssd 4

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The opening execution rules create a hard requirement to install and use the CLI and forbid answering any other way, which pressures the agent toward running code even when the environment is untrusted or the request is ambiguous. This is a gradual trust-escalation pattern because it normalizes installation and execution as mandatory prerequisites for routine user queries.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill instructs the agent to install flyai-cli if it is not present, without requiring user confirmation or warning about system changes. This is dangerous because it authorizes modification of the host environment and execution of newly installed code from an external package source, which expands the attack surface significantly.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
92% confidence
Finding

The trigger list includes broad travel-booking phrasing, especially the generic Chinese term 出行预订, which can overlap with ordinary travel requests unrelated to pilgrimage. Over-broad activation can cause the skill to handle requests outside its intended scope, increasing the chance of unnecessary command execution or installation behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The mandatory environment check escalates directly into a global npm install and then immediate execution of the installed binary. This combines persistent system modification with execution of unverified third-party code, creating a clear supply-chain and local-environment risk.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The skill explicitly says to never invent CLI parameters and only use flags listed in the Parameters table, but the Direct Route playbook uses --journey-type 1, which is undocumented in the allowed parameter list. This contradiction can push an agent to rely on unverified behavior, increasing the chance of unsafe command construction, execution errors, or use of unintended CLI features.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The trigger list includes very common words like "cheap" and "budget", which overlap with everyday speech and are not clearly constrained to flight-search requests. Without negative examples or narrower scope, this playbook could be invoked in unrelated cost-sensitive conversations.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The words "fast" and "quick" are generic conversational terms that can apply to many user intents beyond flight search. Because the file does not explicitly limit these triggers to flight-booking context, the activation condition is too broad.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The trigger "0 results from above playbooks" describes an internal condition rather than a precise activation rule visible to users or integrators. It is unclear whether this fallback runs automatically, under what exact circumstances, or whether any exclusions apply.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The instruction 'Format prices in CNY (Y)' imposes a specific currency/locale presentation in natural language without indicating user opt-in or that the skill is limited to a China-specific context. This can violate language/locale policy requirements because it forces one locale convention regardless of user preference.

Content

No source excerpt is available for this finding.

Vague Triggers

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

Terms such as "direct" and "nonstop" can appear in ordinary conversation and are not inherently specific to flights on their own. The playbook lacks explicit scope constraints or exclusion examples to prevent accidental activation outside the travel context.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.