Security audit

qingming-flight

Security checks for vulnerabilities and agentic risk

Overview

This is a real flight-search skill, but it tells the agent to install an unpinned global npm tool automatically and can activate for ordinary flight-booking requests.

Review before installing. Use it only if you are comfortable with live flight queries being sent to flyai/Fliggy and do not allow automatic global npm installation unless you explicitly approve it. Prefer installing or verifying `@fly-ai/flyai-cli` yourself, ideally with a pinned trusted version, before using the skill.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (9)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill explicitly says agents must never invent CLI parameters and may only use flags listed in the Parameters Table, but the Direct Route playbook later invokes `--journey-type 1`, which is undocumented. This inconsistency can cause agents to trust conflicting instructions and execute unsupported or unintended command variants, increasing the chance of misuse or undefined behavior when interacting with the CLI.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The activation trigger includes the generic phrase `book a flight`, which overlaps with ordinary travel requests and can cause this skill to activate far outside its intended Qingming-specific scope. Overbroad activation increases the likelihood that the agent follows the skill's command-execution workflow unnecessarily, including environment checks and CLI use for unrelated user requests.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The Chinese trigger `订机票` is a very broad booking phrase and is not specific to Qingming travel. This makes accidental activation likely for routine Chinese flight-booking requests, exposing more conversations to the skill's mandatory CLI execution and installation behavior than intended.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically install `flyai-cli` if it is missing, without obtaining user consent or warning that this modifies the system. Silent global installation changes the execution environment, may introduce unreviewed third-party code, and crosses the boundary from answering a query into performing a persistent system action.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The workflow includes `npm i -g @fly-ai/flyai-cli`, a global package installation command, without any disclosure of system impact or trust assumptions. This is dangerous because it can persist software on the host, execute package install scripts, and pull remote code during a simple travel-assistance interaction.

Vague Triggers

Medium

Confidence: 89% confidence
Finding: The Cheapest Option playbook uses broad triggers like "cheap" and "budget", which can match generic user language without clearly indicating the user wants flight results sorted by price. In a travel-booking skill, this can cause unintended playbook selection and steer search behavior in ways the user did not explicitly request, reducing reliability and potentially biasing recommendations.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The Fastest Route playbook is triggered by vague terms like "fast" and "quick", which are highly ambiguous in a multi-service travel skill that also supports hotels, trains, attractions, and itinerary planning. This can unintentionally activate a flight search sorted by speed when the user may mean quick booking, quick answers, or faster options in another domain.

Vague Triggers

Low

Confidence: 83% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and does not clearly define when the broad-search behavior should run. In practice, this can expand queries unexpectedly, including a keyword search, which may return less controlled results and make the skill behave inconsistently or outside the user's original intent.

Ssd 4

Medium

Confidence: 95% confidence
Finding: The skill establishes a staged workflow that normalizes external command execution as mandatory behavior, beginning with environment checks and installation requirements before answering the user. This creates a trust-building path that can push the agent into operating as a system executor rather than a conversational assistant, increasing the chance of unnecessary or unsafe actions on the host environment.

Static analysis

No suspicious patterns detected.