ClawHub
Back to skill

Security audit

pilgrimage-travel

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill is mostly coherent, but it can automatically install a global third-party CLI on the user's machine before searching flights.

Install only if you trust the FlyAI npm package and are comfortable with an agent using it for external travel searches. Prefer manually approving or preinstalling the CLI, verifying the package source, and reviewing booking links before entering personal travel details or purchasing anything.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)

Intent-Code Divergence

Medium
Confidence
92% confidence
Finding
The skill explicitly says only documented parameters may be used, but Playbook D invokes `--journey-type 1`, which is not listed in the Parameters table. This inconsistency can cause undefined behavior, failed execution, or encourage agents to rely on undocumented functionality that may bypass expected validation or drift across CLI versions.

Vague Triggers

Medium
Confidence
76% confidence
Finding
The activation trigger includes `pilgrimage travel`, which is broad enough to match general travel-booking requests that are only loosely related to the intended scope. Overbroad activation can route unrelated user requests into this skill, causing inappropriate command execution and unnecessary handling of booking-related data.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The skill instructs the agent to automatically run `npm i -g @fly-ai/flyai-cli` if the tool is missing, which modifies the host environment without explicit user consent. Automatic global installation increases supply-chain and environment-integrity risk, especially in shared or sensitive systems where package installation should be deliberate and reviewed.

Static analysis

No suspicious patterns detected.