Security audit

wheelchair-flight

Security checks for vulnerabilities and agentic risk

Overview

This travel-search skill is mostly coherent, but it tells agents to install a global third-party CLI and run external searches without clear user consent or privacy disclosure.

Review before installing. Use this only if you are comfortable with a global `@fly-ai/flyai-cli` install and with your travel details, including accessibility needs, being sent to an external travel service. Ask the agent to confirm before installing packages or running searches, and do not rely on this skill as proof that wheelchair assistance is available unless the returned booking source explicitly confirms it.

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The skill explicitly says agents must never invent CLI parameters, yet later uses `--journey-type` in playbooks and parameter mappings without documenting it in the Parameters table. This inconsistency can cause agents to execute unsupported or unintended commands, weakening command safety guarantees and making review of permitted behavior unreliable.

Intent-Code Divergence

Low

Confidence: 83% confidence
Finding: The skill markets itself as wheelchair-accessible flight search, but its mappings equate wheelchair-related requests with direct-flight filtering rather than verified accessibility or mobility-assistance options. This can mislead users into believing accessibility needs are being addressed when the command only changes routing preferences.

Intent-Code Divergence

Low

Confidence: 96% confidence
Finding: The output template instructs the agent to present results as 'Powered by flyai' even though the skill metadata says the provider is Fliggy/Alibaba and the skill is for wheelchair-accessible travel. This creates deceptive branding and provenance confusion, which can mislead users about who is supplying booking links and pricing, reducing trust and potentially causing users to follow links under false assumptions.

Vague Triggers

Medium

Confidence: 88% confidence
Finding: The activation trigger includes broad phrases like 'book a flight' and similar Chinese equivalents, which can cause this skill to activate for generic travel requests unrelated to wheelchair accessibility. Over-broad activation increases the chance the agent runs this skill in the wrong context, leading to unnecessary command execution and unintended data handling.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill instructs the agent to install a global npm package automatically when the CLI is missing, without user consent, provenance checks, or sandboxing guidance. This creates a software supply chain risk because it can trigger network access and execution of unreviewed third-party code on the host environment.

Ssd 3

Medium

Confidence: 76% confidence
Finding: The reference to an execution log 'in the background' suggests retaining operational details, potentially including user travel queries and parameters, beyond the immediate interaction. In a travel-booking context this can expose sensitive itinerary and personal preference data if logs are stored unnecessarily or accessed improperly.

Static analysis

No suspicious patterns detected.