Security audit

round-trip

Security checks for vulnerabilities and agentic risk

Overview

This round-trip flight skill is not clearly malicious, but it needs Review because it can install a global CLI and persist raw travel queries without clear user control.

Install only if you are comfortable with a global npm package installation and external FlyAI travel searches. Ask the agent to get approval before installing anything, avoid writing .flyai-execution-log.json, and verify that searches include both departure and return dates before relying on booking results.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Intent-Code Divergence

Medium

Confidence: 97% confidence
Finding: The skill repeatedly states that round-trip searches must include a return-date flag such as `--back-date`, but none of the documented executable commands actually include that parameter. This inconsistency can cause an agent to produce incomplete or invalid round-trip searches, invent missing parameters, or loop on self-correction logic, reducing reliability for a transactional booking workflow.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The manifest advertises broad capabilities including hotels, trains, visas, insurance, and car rentals, but the body only implements flight-search CLI workflows. This capability mismatch can cause overbroad activation and mislead agents into invoking the skill for unsupported tasks, increasing the chance of hallucinated commands, unsafe fallback behavior, or incorrect handling of user data.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: Playbook D adds a generic `flyai keyword-search` fallback that is broader than the skill’s stated round-trip booking scope. This can cause the agent to invoke an open-ended search path with user-derived input, expanding behavior beyond the advertised capability boundary and potentially enabling unintended actions, data access, or prompt-surface expansion through loosely scoped queries.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The runbook explicitly captures `user_query` as raw input and records every CLI command, then defines a persistence mechanism to append logs locally. For a travel-booking skill, this exceeds what is necessary to fulfill the function and can expose sensitive travel details, personal data, and operational command history if the log file is accessed or reused improperly.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of potentially sensitive data gathered earlier in the schema. In the context of a travel skill, persisted logs can accumulate itinerary details, user requests, and command history without clear necessity, increasing privacy and data-retention risk.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The manifest description is much broader than the actual scope of a round-trip flight skill, which increases the chance that an agent routes unrelated travel requests here. In a tool-executing skill, overbroad activation is dangerous because it can trigger unnecessary command execution, package installation, or external query transmission for unsupported intents.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill instructs the agent to install a global npm package when the CLI is missing, but it does not require user consent or warn that this modifies the host environment. Automatic package installation is a meaningful security risk because it changes system state, pulls remote code, and may execute lifecycle scripts in a privileged or sensitive environment.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The fallback path sends the user's travel query to `flyai keyword-search` without disclosing that the request may be transmitted to an external service. That creates a privacy and data-governance issue, especially if user queries contain personal itinerary details, locations, or dates that should not be shared without notice or consent.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The schema collects `user_query` as raw input and pairs it with an explicit local persistence mechanism, yet the document provides no user-facing disclosure beyond an internal note that the log is not shown to users. Because travel requests commonly contain PII, location history, dates, and booking preferences, this creates a clear privacy and transparency failure with realistic downstream exposure risk.

Static analysis

No suspicious patterns detected.