Security audit

senior-flights

Security checks across malware telemetry and agentic risk

Overview

This flight-search skill is mostly aligned with its purpose, but it asks agents to install a global CLI, may escalate to sudo, and quietly logs raw travel queries.

Review before installing. Only use it if you trust the flyai CLI and are comfortable sending travel details to its service. Do not allow automatic or sudo global installs without explicit approval, disable or remove the execution log behavior, and confirm any changed dates, senior discounts, accessibility accommodations, and booking details directly before purchasing.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The skill explicitly says agents must never invent CLI parameters and only use flags listed in the Parameters table, but later instructs use of `--back-date`, which is not documented there. This inconsistency can cause agents to execute unsupported commands, fail unpredictably, or rely on fabricated interface behavior, undermining safe command execution guarantees.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill mandates installing `@fly-ai/flyai-cli` globally and executing it if absent, which instructs an agent to modify the host environment without explicit user consent or a safety warning. In an agent context, automatic package installation expands the attack surface because it executes third-party code and changes system state beyond the user’s original travel-query intent.

Missing User Warnings

Low

Confidence: 83% confidence
Finding: The fallback workflow sends itinerary details through `keyword-search`, potentially disclosing origin, destination, and travel intent to a broader search pathway without informing the user. While the data is not highly sensitive in all cases, silent transmission to an external service is a privacy concern, especially for agents acting on behalf of users.

Missing User Warnings

High

Confidence: 98% confidence
Finding: The fallback instructs global package installation and then escalation to `sudo npm i -g` without any warning, validation, or user confirmation. Encouraging privileged installation of a package from an external registry is dangerous because it can execute install scripts as root, expanding the blast radius of supply-chain compromise or typo-squatting; in a travel-booking skill, this behavior is unrelated to the user’s task and therefore more suspicious and risky.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The runbook explicitly logs `user_query` as raw input and persists execution logs to a local file, but provides no disclosure, consent, minimization, retention, or redaction controls. In a travel-booking skill, raw user input can contain sensitive personal, financial, health/accessibility, passport, or itinerary data, so persistent storage materially increases privacy and data-exposure risk.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.