Security audit

seasonal-flight

Security checks across malware telemetry and agentic risk

Overview

This is a real seasonal-flight search helper, but it asks for too much automatic system change and quietly stores travel queries locally.

Review before installing. Use it only if you trust the FlyAI CLI and are comfortable sending travel search details to FlyAI/Fliggy-backed services. Require explicit approval for any npm or sudo install, prefer a pinned non-global install, and disable or delete .flyai-execution-log.json if you do not want travel queries saved locally.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The runbook explicitly records the raw user query and full CLI commands in an internal execution log, which can capture sensitive travel details, account identifiers, destinations, dates, and tokens embedded in commands. For a travel search/booking skill, this level of persistent diagnostic logging is broader than necessary and increases the chance of privacy leakage or unintended retention of sensitive operational data.

Context-Inappropriate Capability

Medium

Confidence: 93% confidence
Finding: The runbook instructs appending execution logs to a local file, creating persistent storage of potentially sensitive travel and operational data without showing any need tied to the skill's core function. Persistent local logs widen the exposure window, especially on shared hosts, developer machines, or misconfigured environments where other processes or users may access them.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically run a global package installation (`npm i -g @fly-ai/flyai-cli`) if the CLI is missing, which modifies the host environment without prior user approval. This creates supply-chain and system-integrity risk, especially on developer machines or shared environments, because a prompt-triggered task can cause unreviewed software installation.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The fallback path invokes `flyai keyword-search --query "{origin} to {destination} seasonal flights {season}"`, which may transmit user itinerary details to an external service without notice or consent. Travel plans can be sensitive personal data, and silent transmission increases privacy and compliance risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The schema stores `user_query` as raw input and the runbook states the log is internal and not shown to users, meaning user-provided content may be retained without notice. In this travel context, raw queries can contain names, dates, destinations, passport or visa questions, and other personal trip details, making undisclosed persistence a meaningful privacy risk.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The documented filesystem write persists execution data locally but provides no user-facing warning that request information may be stored on disk. Silent persistence is especially problematic for a consumer travel skill because users may reasonably expect ephemeral processing rather than local retention of itinerary-related inputs and command traces.

VirusTotal

60/60 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.