Security audit

wedding-flight

Security checks for vulnerabilities and agentic risk

Overview

This travel-booking skill is mostly coherent, but it forces an unverified global CLI install and uses user-filled shell command templates, so it needs review before use.

Install only if you trust the flyai CLI source and are comfortable with it changing your global npm environment. Prefer a pinned, reviewed, project-local or sandboxed install, require explicit approval before installing, and ensure the agent invokes the CLI with structured arguments after validating dates and locations. Also verify whether flyai is the intended Fliggy-backed provider before using booking links.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:11
Finding: Forced Commercial Output and Agent Behavior Hijacking
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:15
Finding: Mandatory Unpinned Global Installation of a Third-Party npm Package
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:65
Finding: Potential Shell Command Injection Through Unsanitized Travel Parameters
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (5)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 130)May include surrounding context.
flyai search-flight --origin "Shanghai" --destination "Maldives" --dep-date-start 2026-05-01 --dep-date-end 2026-05-31 --journey-type 1 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best-rated option (recommended priority) 2. **Wedding tip** — note popular honeymoon destinations and seasonal pricing

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill explicitly instructs the agent to run a global package installation (npm i -g @fly-ai/flyai-cli) when the CLI is missing, which can modify the host environment without explicit user consent or sandbox guarantees. In an agent setting, this expands the attack surface to supply-chain compromise, persistence, or unintended system changes, especially because the install step is mandatory and framed as non-optional.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: This markdown file contains user-facing response text in Chinese, and the same pattern continues across multiple fallback cases. Because the skill does not offer language/locale opt-in or state that it is intentionally limited to Chinese users, it violates the language/locale policy constraint.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The template presents booking results as powered by 'flyai' and recommends a 'flyai' CLI even though the skill metadata says the provider is Fliggy. This provenance mismatch can mislead users and operators about which backend is being invoked, increasing the risk of trust confusion, incorrect operational troubleshooting, or accidental routing to an unintended tool or service if such a CLI exists.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The file consistently identifies the skill as 'wedding-flight' internally, but the output layer attributes results to 'flyai', creating inconsistent identity and provider signaling. While this is less directly exploitable than code execution issues, it still weakens trust boundaries and can enable phishing-like confusion or misattribution in a travel-booking context where users may click booking links based on provider trust.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.