Security audit

wine-tour

Security checks for vulnerabilities and agentic risk

Overview

This travel skill is not clearly malicious, but it tells agents to install an unpinned global npm CLI automatically before searching flights.

Install only if you trust the flyai/Fliggy CLI and are comfortable with an agent running flight-search commands and installing `@fly-ai/flyai-cli` globally. Prefer approving any install manually, checking the npm package/source first, and avoiding sensitive travel details unless you trust the provider.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (4)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The skill explicitly states that only parameters listed in the Parameters table may be used, yet Playbook D introduces `--journey-type 1`, which is undocumented in the file. This creates a trust gap where an agent may execute an unreviewed flag with unknown behavior, increasing the risk of unintended actions or bypassing safety assumptions about allowed CLI usage.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The skill directs the agent to install and then execute a global npm package (`npm i -g @fly-ai/flyai-cli`) automatically if the CLI is missing, without requiring user confirmation or providing any warning. Auto-installing and running external code from a package registry expands the trust boundary significantly and can lead to supply-chain compromise, arbitrary code execution, or unsafe modification of the host environment.

Vague Triggers

Medium

Confidence: 93% confidence
Finding: The trigger terms "cheap" and "budget" are very broad and can appear in many travel-related or even unrelated user requests, which increases the chance that this playbook activates when the user did not specifically ask for flight-search behavior. In a booking skill, misrouting a request can cause unintended searches, confusion, or inappropriate downstream actions based on the wrong user intent.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The triggers "fast" and "quick" are highly ambiguous and do not reliably indicate that the user wants the fastest flight route. These words could refer to response speed, itinerary generation, or unrelated preferences, so automatic activation can produce incorrect flight searches or unintended workflow selection.

Static analysis

No suspicious patterns detected.