Security audit

reunion-trip

Security checks for vulnerabilities and agentic risk

Overview

This is a mostly coherent flight-search skill, but it can automatically install a global third-party CLI and trigger on broad travel phrases without clear user approval.

Review before installing. Use this only if you are comfortable with an agent running flyai commands, sharing travel search details with the provider, and potentially installing a global npm package. Prefer requiring explicit approval before any install or search command, and verify the CLI package/version independently.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Intent-Code Divergence

Medium

Confidence: 91% confidence
Finding: The skill explicitly states that only parameters listed in the table may be used, yet a later playbook invokes an undocumented `--journey-type` flag. This inconsistency can cause agents to ignore the stated safety boundary, invent unsupported commands, or execute behavior that was not reviewed or documented, increasing the risk of unsafe or unreliable command execution.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation trigger includes the very broad phrase `plan a trip`, which is not specific to reunion travel and can cause the skill to activate for many unrelated travel requests. In an agent setting, overbroad activation increases the chance the skill runs unexpectedly, invokes external tooling, or installs software when the user did not intend to use this skill.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs the agent to run `npm i -g @fly-ai/flyai-cli` automatically if the CLI is missing, without requiring user confirmation or warning that this modifies the host environment. In practice, this enables unprompted installation of third-party software with system-wide effects, which is a significant supply-chain and environment-integrity risk.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger phrase set includes very broad terms like "cheap" and "budget," which are common in ordinary travel conversations and can activate this playbook without a clear, skill-specific invocation. In a travel-booking skill, that can cause unintended tool use or route the user into a pricing workflow they did not explicitly request, especially if the surrounding system auto-selects playbooks from loose phrase matches.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: Triggers like "fast" and "quick" are highly ambiguous and can refer to many user intents unrelated to flight sorting. Because this playbook maps them directly to a flight search sorted by speed, the skill may misinterpret conversational language and perform unintended searches, which is a genuine control-boundary weakness in an agentic system.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The fallback condition "0 results from above playbooks" is underspecified and creates a broad activation path that may fire after multiple unrelated matching attempts. In an agent skill, vague fallback boundaries can lead to unexpected secondary actions and make behavior harder for users to predict or consent to.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The fallback path silently expands from a structured flight search to an additional keyword-based search, which broadens scope without notifying the user. That matters because keyword search may behave differently, use less precise matching, or query a wider corpus, increasing the chance of irrelevant results, unintended data exposure, or user confusion about what the agent is doing.

Static analysis

No suspicious patterns detected.