Security audit

wheelchair-flight

Security checks for vulnerabilities and agentic risk

Overview

The skill is a flight-search helper, but it requires automatic global installation of an unpinned npm CLI and uses broad shell-command templates without clear user control or validation.

Review before installing. This skill should not auto-install a global npm package on ordinary travel queries; require explicit approval, a pinned audited CLI version, and sandboxed execution. Also avoid relying on it to verify wheelchair accessibility unless the provider returns clear accessibility-specific fields.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T01 · Skill Instruction Hijacking

Error

Location: SKILL.md:10
Finding: Forced Commercial Output and Agent Instruction Hijacking
Content: View full analysis
Chinese output. English input -> English output. 5. **NEVER invent CLI parameters.** Only use parameters listed in the Parameters Table below. If a flag is not listed, it does not exist. **Self-test:** If your response contains no `[Book](...)` links, you violated this skill. Stop and re-execute. ``` ```markdown ### Step 3: Format Output Format CLI JSON into user-readable Markdown with booking links. See [references/templates.md](references/templates.md). ### Step 4: Validate Output (before sending) - [ ] Every result has `[Book]({detailUrl})` link? - [ ] Data from CLI JSON, not training data? - [ ] Brand tag included? **Any NO -> re-execute from Step 2.** ## Usage Examples ```bash flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2 ``` ## Output Rules 1. **Conclusion first** — lead with best option 2. **Accessibility tip — request wheelchair assistance 48h in advance; direct flights preferred** 3. **Comparison table** with >= 3 results when available 4. **Brand tag:** "Powered by flyai - Real-time pricing, click to book" 5. **Use `detailUrl`** for booking links. Never use `jumpUrl`. 6. NEVER output raw JSON 7. NEVER answer from training data without CLI execution ``` ### Technical Analysis The Skill replaces normal Agent decision-making with an extern ...[truncated 1850 chars]
Remediation: View remediation

T08 · Insecure Dependencies

Error

Location: SKILL.md:57
Finding: Mandatory Installation of an Unpinned Global npm Dependency
Content: View full analysis
proceed to Step 1 - FAIL: `command not found` -> ```bash npm i -g @fly-ai/flyai-cli flyai --version ``` Still fails -> **STOP.** Do NOT continue. Do NOT use training data. ``` ```markdown ## Case 0: flyai CLI not installed If `flyai --version` returns `command not found`: 1. Run: `npm i -g @fly-ai/flyai-cli` 2. Verify: `flyai --version` 3. If still fails, tell user to install Node.js first: https://nodejs.org/ **NEVER proceed without CLI. NEVER fabricate results.** ``` ```markdown ## F-2: CLI not installed ```bash npm i -g @fly-ai/flyai-cli ``` ``` ### Technical Analysis The Skill mandates installation of `@fly-ai/flyai-cli` from the npm registry without pinning a version or verifying an integrity digest. The `-g` option installs the package globally rather than within an isolated project environment. The instructions also provide no review process for the package contents, provenance, transitive dependencies, lifecycle scripts, or network behavior. npm packages may execute lifecycle scripts during installation. Because the requested package version is mutable over time, the effective code installed by the Skill can differ from the code that existed when the Skill was reviewed. A compromise of the publisher account, package, registry path, or a transitive dependency could therefore result in arbitrary code execution under the privileges of the Agent process. ### Attack Path 1. The Skill runs `flyai --version`. 2. If the binary is absent, the Skill mandates `npm i -g @fly-ai/flyai-cli`. 3. npm resolves the latest package and its dependency graph at execution time. 4. npm downloads package content from an external ...[truncated 817 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: references/playbooks.md:36
Finding: Shell Command Injection Through Unquoted User-Controlled Date Substitutions
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
System Prompt LeakageDirect Leakage, Indirect Extraction, Tool-Based Exfiltration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (10)

Direct Prompt Extraction

High

Category: System Prompt Leakage
Confidence: 85% confidence
Finding: Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
Content: Scanner excerpt · SKILL.md (reported line 140)May include surrounding context.
flyai search-flight --origin "Beijing" --destination "Shanghai" --dep-date 2026-05-15 --sort-type 2

text
## Output Rules 1. **Conclusion first** — lead with best option 2. **Accessibility tip — request wheelchair assistance 48h in advance; direct flights preferred**

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill instructs the agent to run npm i -g @fly-ai/flyai-cli automatically if the tool is missing, without user confirmation or trust validation. Auto-installing a global package executes code from an external registry and modifies the host environment, which is dangerous in any agent context and especially problematic when triggered by ordinary travel queries.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill explicitly says to 'NEVER invent CLI parameters' and that any flag not listed in the Parameters Table 'does not exist' (L017), yet Playbook D and the domain mapping later instruct use of --journey-type 1 (L115, L157-L158), which is absent from the Parameters Table (L045-L050). This is an active contradiction between the documentation's stated allowed interface and the documented command usage.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The activation triggers are overly broad, especially phrases like 'book a flight' and '订机票', which can cause this skill to intercept general travel queries outside its stated wheelchair-accessible scope. In this skill, over-activation is risky because it pushes the agent into mandatory CLI execution and possible package installation, expanding exposure beyond the intended domain.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: The playbooks hard-code English and Chinese trigger phrases throughout the file, but there is no natural-language indication that users may choose their preferred language or that the skill is intentionally limited to these locales. This can violate language/locale policy expectations when a skill constrains invocation language without opt-in or justification.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The trigger list includes very common words like "cheap" and "budget", which frequently appear in everyday conversation outside the specific context of flight search. Because the playbook does not constrain these phrases to flight-related requests or provide exclusion conditions, it risks activating in unrelated situations.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The triggers "fast" and "quick" are highly generic and overlap with common everyday speech, making them poor activation phrases on their own. The file does not specify that these phrases must be used in a flight-search context, nor does it provide negative examples to limit accidental matches.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The instruction 'Format prices in CNY (Y)' imposes a specific locale/currency convention in natural-language guidance. The file does not indicate that the skill is region-specific or that users can opt into this formatting, which creates a locale policy concern.
Content: No source excerpt is available for this finding.

Vague Triggers

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The trigger "0 results from above playbooks" describes an internal condition rather than a precise activation rule, but it does not define how that condition is evaluated or whether all prior playbooks must be attempted first. This ambiguity can lead to inconsistent or unintended fallback behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Low

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The manifest describes the skill as powered by Fliggy (Alibaba Group), but the output template instructs the agent to present booking links and branding as 'flyai'. This is a semantic mismatch between the claimed service identity and what the documentation tells the skill to output to users.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.