ClawHub
Back to skill

Security audit

red-flights

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill has a coherent purpose, but it needs review because it mandates global third-party CLI installation, suggests sudo, and persists raw travel queries without enough user control.

Install only after reviewing the flyai CLI source/provenance and avoiding automatic global or sudo installation. Prefer a pinned, local, nonprivileged install, validate all travel inputs before command execution, treat booking links as external commercial links, and disable or redact persistent logs containing raw user queries.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (5)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:8
Finding

Forced Promotional Output and Booking-Link Injection

Content
View full analysis
Remediation
View remediation

T08 · Insecure Dependencies

Error
Location
SKILL.md:78
Finding

Mandatory Unpinned Global Third-Party Package Installation

Content
View full analysis
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
references/fallbacks.md:3
Finding

Privilege Escalation Through Automatic Sudo Installation Fallback

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:96
Finding

Shell Command Injection Through Unsanitized Query Interpolation

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
references/runbook.md:7
Finding

Unsafe Persistence of Raw User Input Through a Shell Echo Command

Content
View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The logging schema retains the raw user query and complete command history. The generated JSON is then embedded directly inside a single-quoted shell argument. A user query containing a single quote can terminate the quoted string when the template is rendered. Additional shell syntax can then become executable if the completed text is passed to a shell. Even without command injection, this design creates a hidden persistent file containing raw query content and command details. The document does not specify user consent, retention limits, restrictive permissions, redaction, secure placement, file locking, or maximum file size. Directly substituting raw text into the JSON template can also produce invalid JSON when the query contains quotation marks, backslashes, or control char ...[truncated 1236 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (6)

Direct Prompt Extraction

High
Category
System Prompt Leakage
Confidence
85% confidence
Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 164)May include surrounding context.

flyai search-flight --origin "Shanghai" --destination "Guangzhou" --dep-date 2026-06-15 --dep-hour-start 21 --dep-hour-end 6 --journey-type 1 --sort-type 3

text

## Output Rules

1. **Conclusion first** — lead with cheapest red eye or key finding
2. **Comparison table** with ≥ 3 results when available

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The skill explicitly instructs the agent to run a global package installation (npm i -g @fly-ai/flyai-cli) automatically when the CLI is missing. This causes unreviewed code from an external package registry to be fetched and executed on the host without user consent, which expands the attack surface and can lead to supply-chain compromise or unauthorized system modification.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The fallback instructs the agent to send a free-form query containing origin and destination data to flyai keyword-search without any privacy notice or user approval. Even if itinerary details seem low sensitivity, this still transmits user travel intent to a third-party service in a broader, less structured form than the primary search flow, increasing privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium
Category
Privilege Escalation
Confidence
93% confidence
Finding

The fallback explicitly suggests rerunning a package installation with sudo, which encourages elevated-privilege execution of a network-fetched npm package. If the package, its dependencies, or the install path are compromised, this can lead to system-wide code execution or persistence with root privileges.

Content

Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.

bash
npm i -g @fly-ai/flyai-cli
flyai --version
# Fails → sudo npm i -g @fly-ai/flyai-cli
# Still fails → STOP. Do NOT answer with training data.
# Tell user: "Please run npm i -g @fly-ai/flyai-cli manually."

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The runbook explicitly requires logging the raw user query (user_query: {raw input}) in an internal execution log, while also stating the log is not shown to users. In a travel skill, user queries may contain names, dates, locations, booking details, passport/visa context, or other sensitive travel data, so collecting and retaining this without clear notice or minimization creates a privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The runbook instructs appending execution logs to a local file (.flyai-execution-log.json) whenever filesystem writes are available, which can persist previously logged user data on disk. Because the same log schema includes raw user input and operational details, this increases exposure through local compromise, accidental inclusion in artifacts, backups, or broader-than-intended file access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.