Security audit

seasonal-flight

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is mostly about flight search, but it asks the agent to install a global CLI, may escalate to sudo, builds shell commands from user travel details, and persists raw user queries locally.

Review before installing. Use only in an environment where global npm installs are allowed, do not run the sudo fallback, and avoid entering sensitive personal, passport, booking, or account details unless logging is removed or explicitly controlled. Prefer a version that pins the CLI dependency, validates parameters, avoids shell interpolation, discloses third-party routing, and disables raw persistent logs by default.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:9
Finding: Mandatory Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: references/fallbacks.md:3
Finding: Unpinned Global Package Installation with Sudo Escalation
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:15
Finding: Shell Command Injection Through User-Controlled Travel Parameters
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/runbook.md:31
Finding: Unsafe Persistent Logging of Raw User Input
Content: View full analysis
> .flyai-execution-log.json ``` ``` ### Technical Analysis The runbook requires logging the complete raw user query, collected parameters, executed commands, and fallback commands. Travel queries can reveal locations, dates, budgets, and itinerary information. No consent, access-control requirement, retention limit, rotation policy, or redaction procedure is defined. The persistence mechanism is also unsafe. It embeds generated JSON inside a single-quoted shell command. JSON escaping does not ordinarily escape apostrophes because apostrophes have no special meaning in JSON strings. A raw user query containing an apostrophe can therefore terminate the shell's single-quoted string. An attacker-controlled query can potentially transform the intended append command into multiple shell commands. This creates a second command-injection path in ...[truncated 1277 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (8)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 153)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Sanya" --dep-date-start 2026-07-01 --dep-date-end 2026-08-31 --sort-type 3

text
## Output Rules 1. **Conclusion first** — lead with best seasonal option 2. **Seasonal note** — indicate whether price is peak or off-peak

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The manifest advertises broad travel capabilities such as hotels, trains, visas, insurance, and car rentals, but the implementation only defines seasonal-flight workflows. This mismatch can cause incorrect skill activation or user trust issues, and in multi-skill agents it may route unrelated requests into a workflow that then installs tools or executes commands unnecessarily.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill mandates a global npm install (npm i -g @fly-ai/flyai-cli) as part of normal execution without user confirmation or safety gating. This is dangerous because it modifies the host environment, pulls and executes third-party package installation code, and could be abused on sensitive systems or CI/agent runtimes where package installation is prohibited.
Content: No source excerpt is available for this finding.

Sudo/Root Execution

Medium

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
Content: Scanner excerpt · references/fallbacks.md (reported line 10)May include surrounding context.
bash
npm i -g @fly-ai/flyai-cli flyai --version # Fails → sudo npm i -g @fly-ai/flyai-cli # Still fails → STOP. Do NOT answer with training data. # Tell user: "Please run npm i -g @fly-ai/flyai-cli manually."

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The fallback playbook sends a constructed itinerary query containing origin, destination, and season to a generic keyword-search command without any indication of user consent, disclosure, or minimization. In a travel skill, those parameters can reveal planned travel behavior, and broad search tools may route data to external search/indexing systems with different privacy expectations than a direct flight lookup.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The runbook explicitly records user_query as raw input in an internal execution log, while also stating the log is not shown to users. In a travel-booking context, user queries can contain names, dates, destinations, booking references, passport/visa details, or other sensitive travel data, so storing them without minimization or disclosure creates a real privacy and retention risk.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: Taken together, the schema captures natural-language user_query, command history, fallback actions, and output metadata, then persists that data to disk. This creates a compounded data leakage risk because free-form user text often contains sensitive information, and command/result traces can further reveal internal workflow details or user-specific travel activity.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The runbook instructs appending execution logs to a local file .flyai-execution-log.json whenever filesystem writes are available, but provides no notice, access controls, retention limits, or encryption guidance. Persistent local storage increases the chance that sensitive travel and booking-related data can be exposed to other processes, users, backups, or later compromise.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.