Security audit

shopping-trip

Security checks for vulnerabilities and agentic risk

Overview

This flight-search skill is purpose-related, but it tells the agent to install and run a global third-party CLI without a clear user approval step.

Review this before installing. Only use it if you trust the flyai/Fliggy CLI and are comfortable manually approving any CLI installation. Prefer installing the CLI yourself in an isolated environment, verify the npm package, and avoid entering sensitive travel details unless you trust the provider.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to automatically install `flyai-cli` if it is missing, which normalizes modifying the host environment without explicit user consent. Installing a global package based solely on skill content expands the attack surface, can execute package lifecycle scripts, and can introduce supply-chain risk on the user's machine.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The prerequisite flow includes `npm i -g @fly-ai/flyai-cli` without warning that it changes the system globally. Global installation can run untrusted package scripts, alter PATH-visible tooling, and persist changes beyond the current task, which is unsafe if triggered automatically by an agent.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The fallback instructs the operator to run a global npm install (`npm i -g @fly-ai/flyai-cli`) directly on the host system without any warning, confirmation, or safer alternative. This can cause unintended system modification, dependency trust issues, and privilege/environment changes, especially if followed automatically by an agent or unsuspecting user.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The trigger set for the 'Fastest Route' playbook includes very common words like 'fast' and 'quick', which can appear in many unrelated travel or shopping conversations. This can cause unintended invocation of a flight-search workflow, leading the agent to take the wrong action or surface irrelevant booking results without sufficiently specific user intent.

Vague Triggers

Medium

Confidence: 94% confidence
Finding: The fallback playbook is activated by '0 results from above playbooks', but one of its commands uses a broad keyword search built from origin and destination text, which can expand behavior beyond tightly scoped flight search. In this travel-booking context, broad activation and looser search behavior increase the chance of unintended tool use, irrelevant results, or misrouting from ambiguous user requests.

Ssd 4

Medium

Confidence: 96% confidence
Finding: The workflow explicitly tells the agent to check for a CLI, install it if absent, and then rely exclusively on that tool before answering. This creates a progressive execution pattern where untrusted skill text can induce host command execution and software installation, increasing the risk of unintended code execution and supply-chain compromise.

Static analysis

No suspicious patterns detected.